CVE-2023-40105: Package name ownership not checked in ActivityManagerService#backupAgentCreated
Summary
CVE-2023-40105: In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. Affects platform/frameworks/base across 6 version ranges.
>= 11:0, < 11:2023-11-01
>= 12:0, < 12:2023-11-01
>= 12L:0, < 12L:2023-11-01
>= 13:0, < 13:2023-11-01
>= 14:0, < 14:2023-11-01
>= 14-next:0, < 14-next:2023-11-01
Fixed in 14-next:2023-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base, which is a part of the Android ecosystem. It is responsible for providing the fundamental functionality and services required by the Android operating system. This package includes various components and APIs that facilitate the execution of applications and system processes. One of the critical components is the ActivityManagerService, which manages the lifecycle and execution of activities and services. However, a vulnerability has been identified in the backupAgentCreated method of ActivityManagerService, which can lead to local information disclosure.
Vulnerability Detail
The vulnerability arises due to a missing permission check in the backupAgentCreated method of ActivityManagerService. This flaw allows an attacker to leak sensitive data without requiring any additional execution privileges or user interaction. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information stored within the Android system. This can lead to potential privacy breaches and compromise the confidentiality of user data.
How To Fix
Minimum fixed version
14-next:2023-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the package platform/frameworks/base in the Android ecosystem is vulnerable to a missing permission check in the backupAgentCreated method of ActivityManagerService. This vulnerability allows for local information disclosure, potentially compromising the confidentiality of sensitive data. It is crucial to apply the provided patch to fix this vulnerability and ensure the security of the Android system.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability can lead to local information disclosure, allowing an attacker to access sensitive data stored within the Android system.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability was introduced in Android 11 and affects all subsequent versions up to Android 14.
There are no known instances of this vulnerability being exploited in the wild.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
