CVE-2024-45351

Executive Summary

CVE-2024-45351 is a code execution vulnerability in the Xiaomi Game Center application. The flaw stems from improper input validation, allowing an attacker to execute arbitrary code on the affected device. With a CVSS score of 7.8, this vulnerability is considered high severity. The attack vector is local, requiring user interaction (e.g., opening a malicious link or file). No public proof-of-concept (PoC) or exploit code is currently available, and no official patch has been released by Xiaomi. The EPSS score of 0.0% indicates a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Android application vulnerability within the Xiaomi ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – The attacker must have physical or logical access to the device.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must perform an action (e.g., click a link).
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: High. While no active exploitation is reported, the potential for code execution on millions of Xiaomi devices makes this a critical concern for users.

Deep Dive & Mechanics

The vulnerability resides in the Xiaomi Game Center application, a pre-installed system app on many Xiaomi devices. The core issue is improper input validation (CWE-20). The application likely processes external data (e.g., game links, deep links, or configuration files) without adequately sanitizing or verifying the input. An attacker can craft a malicious input that, when processed by the Game Center, triggers a buffer overflow, format string vulnerability, or other memory corruption issue, leading to arbitrary code execution.

Attack Scenario:

1. An attacker crafts a malicious link or file that exploits the input validation flaw.
2. The attacker delivers the payload via social engineering (e.g., SMS, email, or a malicious website).
3. The victim clicks the link or opens the file, which is handled by the Xiaomi Game Center.
4. The Game Center processes the malicious input, executing the attacker's code with the privileges of the Game Center application (likely system-level).
5. The attacker gains full control over the device.

Vulnerable vs. Patched Code

No official patch or patched code is available. The following is a hypothetical example of the vulnerable pattern and a potential fix.

Vulnerable Code (Hypothetical Java/Android):

// Vulnerable: Directly using user input without validation
public void handleDeepLink(String deepLink) {
    // Assume deepLink is from an intent
    String action = deepLink.split("://")[1];
    // No validation of 'action' - could contain malicious payload
    executeAction(action);
}

Patched Code (Hypothetical):

// Patched: Validate and sanitize input
public void handleDeepLink(String deepLink) {
    if (deepLink == null || !deepLink.startsWith("gamestore://")) {
        return; // Reject invalid input
    }
    String action = deepLink.split("://")[1];
    // Whitelist allowed actions
    if (!allowedActions.contains(action)) {
        return; // Reject unknown actions
    }
    executeAction(action);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Xiaomi device with the vulnerable Game Center version.
• A method to deliver the malicious payload (e.g., a web server or SMS).

Exploitation Steps:

1. Craft Payload: Create a malicious deep link that exploits the input validation flaw. For example:

   gamestore://malicious_command
   

2. Deliver Payload: Send the link to the victim via SMS or host it on a website.
3. Trigger Exploit: The victim clicks the link, causing the Game Center to process the malicious input.
4. Execute Code: The exploit triggers code execution, potentially installing a backdoor or exfiltrating data.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense)

Detection & Prevention:

• Monitor for Suspicious Deep Links: Log and alert on unusual deep link patterns targeting the Game Center.
• Application Sandboxing: Ensure the Game Center runs with minimal privileges.
• User Education: Warn users not to click on unsolicited links from unknown sources.
• Network Segmentation: Isolate Xiaomi devices on a separate network segment.

Hunting Queries:

• Search for processes spawned by the Game Center with unusual arguments.
• Monitor for outbound connections from the Game Center to unknown IPs.

Indicators of Compromise (IOCs)

File IOCs:

• Suspicious files in /data/data/com.xiaomi.gamecenter/ with unexpected names or sizes.
• Modified or unknown .dex or .so files in the Game Center's library directory.

Network IOCs:

• Outbound connections to IP addresses associated with known malicious infrastructure.
• DNS queries for domains related to exploit delivery.

Behavioral IOCs:

• Unexpected high CPU or memory usage by the Game Center process.
• Unusual system calls or file access patterns from the Game Center.

Detection Engineering

YARA Rule

rule CVE_2024_45351_Xiaomi_GameCenter {
    meta:
        description = "Detects potential exploitation of CVE-2024-45351 in Xiaomi Game Center"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "gamestore://" ascii wide nocase
        $s2 = "malicious_command" ascii wide nocase
        $s3 = "executeAction" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: CVE-2024-45351 Xiaomi Game Center Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-45351 via malicious deep links
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: android
detection:
    selection:
        Image|endswith: '/com.xiaomi.gamecenter'
        CommandLine|contains: 'gamestore://'
    condition: selection
falsepositives:
    - Legitimate Game Center deep links
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45351 Xiaomi Game Center Exploit Attempt"; flow:to_server; content:"gamestore://"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or Uninstall: If possible, disable or uninstall the Xiaomi Game Center application until a patch is available.
2. Restrict Permissions: Revoke unnecessary permissions (e.g., storage, SMS) from the Game Center app.
3. User Awareness: Educate users about the risks of clicking unknown links.

Long-Term Fix:

• Vendor Patch: Await an official update from Xiaomi. Monitor the Xiaomi security bulletin for CVE-2024-45351.
• Input Validation: Implement strict input validation and sanitization for all external data processed by the application.
• Code Review: Conduct a thorough security audit of the Game Center's input handling code.

Workarounds:

• Use a third-party security solution that can detect and block malicious deep links.
• Implement network-level filtering to block known malicious domains.

Valters IT – Securing Digital Ecosystems