CVE-2024-45355

Executive Summary

CVE-2024-45355 is a medium-severity vulnerability (CVSS 5.5) affecting the Xiaomi phone framework. The flaw stems from improper validation of access controls, allowing an attacker with local access to invoke sensitive methods within the framework. This could lead to unauthorized access to system functions, data leakage, or privilege escalation. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score of 0.0% indicates a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue within Xiaomi’s proprietary Android-based MIUI framework.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – Requires physical or ADB access to the device.
• Attack Complexity: Low (AC:L) – No special conditions needed.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for local privilege escalation make this a concern for Xiaomi device users, especially in enterprise environments.

Deep Dive & Mechanics

The vulnerability resides in the Xiaomi phone framework, a core system service that manages inter-process communication (IPC) and access to sensitive device APIs. The framework fails to properly validate the caller’s identity or permissions when certain sensitive methods are invoked. This allows a malicious application or an attacker with ADB (Android Debug Bridge) access to call these methods without proper authorization.

Root Cause: Improper input validation or missing permission checks in the framework’s binder interface. The framework likely exposes a service that does not enforce the correct Android permissions (e.g., android.permission.SYSTEM_ALERT_WINDOW or android.permission.INTERACT_ACROSS_USERS_FULL).

Attack Vector: An attacker can exploit this by:

1. Installing a malicious app on the device.
2. Using ADB commands from a connected computer.
3. Crafting an intent or binder transaction that targets the vulnerable method.

Impact: Successful exploitation could allow the attacker to:

• Access sensitive system settings.
• Read or modify device identifiers (IMEI, serial number).
• Interact with other apps’ data.
• Potentially escalate to system-level privileges.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, based on the CWE-20 (Improper Input Validation) classification, the vulnerable code likely resembles:

Vulnerable (Conceptual):

// Vulnerable method in Xiaomi framework service
public Bundle callSensitiveMethod(String action, Bundle args) {
    // No permission check
    return processAction(action, args);
}

Patched (Conceptual):

// Patched method with permission enforcement
public Bundle callSensitiveMethod(String action, Bundle args) {
    // Check for required permission
    enforceCallingPermission("com.xiaomi.permission.SENSITIVE_ACCESS", null);
    return processAction(action, args);
}

The patch would involve adding proper permission checks using Android’s Context.enforceCallingPermission() or similar mechanisms.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Xiaomi device running a vulnerable MIUI version.
• ADB enabled or ability to install a malicious APK.

Exploitation Steps (Conceptual):

1. Identify the vulnerable service: Use dumpsys package or service list to find Xiaomi framework services.
2. Craft an exploit script: Use Android’s ServiceManager or Binder to call the vulnerable method.
3. Execute the exploit:

   # Example ADB command to invoke a binder transaction
   adb shell service call xiaomi_framework 1 i32 12345 s16 "getSensitiveData"
   

   Or via a malicious app:

   // Malicious app code
   IBinder binder = ServiceManager.getService("xiaomi_framework");
   Parcel data = Parcel.obtain();
   Parcel reply = Parcel.obtain();
   data.writeString("getSensitiveData");
   binder.transact(1, data, reply, 0);
   String result = reply.readString();
   

Expected Outcome: The attacker retrieves sensitive data (e.g., device IMEI, serial number) or performs unauthorized actions.

Blue Team

Detection:

• Monitor for unusual binder transactions targeting Xiaomi framework services.
• Look for apps requesting suspicious permissions or using ServiceManager directly.
• Enable ADB logging and watch for service call commands from non-root users.

Mitigation:

• Restrict ADB access to authorized users only.
• Use Mobile Device Management (MDM) to enforce security policies.
• Monitor for known exploit patterns using the Sigma rule below.

Indicators of Compromise (IOCs)

• Process: com.xiaomi.framework or system_server with unusual binder transactions.
• File: /data/system/xiaomi_framework.log (if logging is enabled).
• Network: No network IOCs expected as this is a local vulnerability.
• Behavior: Sudden access to sensitive system APIs without proper permissions.
• ADB Logs: Entries containing service call xiaomi_framework or Binder: transaction failed errors.

Detection Engineering

YARA Rule

rule Xiaomi_Framework_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-45355 via malicious APK or ADB commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45355"
    strings:
        $s1 = "xiaomi_framework" ascii wide nocase
        $s2 = "getSensitiveData" ascii wide nocase
        $s3 = "ServiceManager.getService" ascii wide nocase
        $s4 = "binder.transact" ascii wide nocase
    condition:
        any of ($s*) and filesize < 2MB
}

Sigma Rule

title: Xiaomi Framework Unauthorized Access Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2024-45355 via ADB or malicious app
author: Valters IT
logsource:
    product: android
    service: logcat
detection:
    selection:
        - "service call xiaomi_framework"
        - "Binder: calling from pid"
        - "com.xiaomi.framework"
    condition: selection
falsepositives:
    - Legitimate system operations
level: medium

Suricata Rule

alert ip any any -> any any (msg:"Xiaomi Framework Exploit Attempt"; content:"xiaomi_framework"; content:"getSensitiveData"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Monitor for updates: Check Xiaomi’s security bulletin regularly for a patch.
2. Restrict ADB: Disable ADB on production devices or use secure USB debugging.
3. App Vetting: Only install apps from trusted sources (Google Play Store).
4. Least Privilege: Use Android’s permission model to restrict app capabilities.

Long-Term Fix:

• Apply the official patch once released by Xiaomi.
• Implement network segmentation for enterprise devices.
• Use Mobile Threat Defense (MTD) solutions to detect anomalous behavior.

Workarounds:

• If possible, downgrade to a known secure MIUI version (if available).
• Use a custom ROM that has patched the vulnerability (not recommended for production).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert