Open Source Vulnerability in platform/frameworks/base: Enumerate photos across users by SystemUI media resumption
Summary
CVE-2023-40081: In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-03-01
>= 12L:0, < 12L:2024-03-01
>= 13:0, < 13:2024-03-01
>= 14:0, < 14:2024-03-01
>= 14-next:0, < 14-next:2024-03-01
Fixed in 14-next:2024-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package platform/frameworks/base is a fundamental component of the Android ecosystem. It provides core functionalities and services for the Android operating system. One of its key features is the SystemUI, which is responsible for managing the user interface and various system-level tasks. However, a vulnerability has been discovered in the SystemUI media resumption feature, which allows for the enumeration of photos across users.
Vulnerability Detail
The vulnerability exists in the loadMediaDataInBgForResumption function of the MediaDataManager.kt file. Due to a confused deputy issue, it is possible to view another user's images without proper authorization. This vulnerability can be exploited locally, leading to the disclosure of sensitive information. It is important to note that no additional execution privileges are required, and user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
14-next:2024-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in platform/frameworks/base allows for the enumeration of photos across users by exploiting the SystemUI media resumption feature. It is crucial to apply the provided fix and keep the Android operating system up to date to mitigate the risk of local information disclosure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows an attacker to view another user's images without proper authorization. This can lead to the disclosure of sensitive information and potential privacy breaches.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability was introduced in Android 11 and affects subsequent versions up to Android 14.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the gradle.lockfile, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
