BAL bypass while calling locationManager.requestGeofence in platform/frameworks/base
Summary
CVE-2023-40095: In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check. Affects platform/frameworks/base across 6 version ranges.
>= 11:0, < 11:2023-12-01
>= 12:0, < 12:2023-12-01
>= 12L:0, < 12L:2023-12-01
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a core component of the Android operating system. It provides fundamental functionalities and services for the Android framework. This package includes various modules and libraries that handle essential system operations, such as managing processes, handling user interfaces, and providing access to hardware resources. One of the modules within this package is the locationManager, which is responsible for location-based services. It allows applications to request location updates and define geofences for monitoring specific geographic areas. However, a vulnerability has been identified in the implementation of the locationManager.requestGeofence method, which could lead to a bypass of the Background Activity Launch (BAL) restriction.
Vulnerability Detail
The vulnerability in the platform/frameworks/base package allows for a bypass of the BAL restriction when calling the locationManager.requestGeofence method. This means that an application can launch background activities without the necessary user interaction or permission. This vulnerability can be exploited by an attacker to escalate their privileges locally, potentially leading to unauthorized access or malicious activity. The vulnerability affects Android versions 11, 12, 12L, 13, and 14. A fix has been implemented in the platform/frameworks/base package, and users are advised to update their Android devices to the latest available version.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are strongly advised to update their Android devices to the latest available version to mitigate the risk of exploitation.
Conclusion
The vulnerability in the platform/frameworks/base package allows for a bypass of the BAL restriction, potentially leading to local privilege escalation and unauthorized background activity launch. Users are advised to update their Android devices to the latest available version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows for a bypass of the Background Activity Launch (BAL) restriction, potentially enabling unauthorized background activity launch without user interaction or permission. It could lead to local privilege escalation and unauthorized access to sensitive information.
This vulnerability affects Android versions 11, 12, 12L, 13, and 14.
Yes, a fix has been implemented in the platform/frameworks/base package. Users are advised to update their Android devices to the latest available version to ensure they are protected against this vulnerability.
No, there is no known workaround for this vulnerability. Updating the Android device to the latest available version is the recommended solution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the gradle.lockfile without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
