CVE-2023-40111: Vulnerability in platform/frameworks/base - Start foreground activity from background via MediaSession#setMediaButtonReceiver
Summary
CVE-2023-40111: In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. Affects platform/frameworks/base across 2 version ranges.
>= 14:0, < 14:2023-11-01
>= 14-next:0, < 14-next:2023-11-01
Fixed in 14-next:2023-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package platform/frameworks/base is a fundamental component of the Android ecosystem. It provides core functionalities and services for the Android operating system. One of its features is the MediaSession, which allows applications to interact with media playback controls. However, a vulnerability has been discovered in the MediaSession#setMediaButtonReceiver method, which can be exploited to start a foreground activity from the background without proper authorization.
Vulnerability Detail
The vulnerability in MediaSession#setMediaButtonReceiver allows an attacker to send a pending intent on behalf of system_server, leading to a confused deputy scenario. This can result in a local escalation of privilege, enabling the attacker to gain elevated privileges without requiring additional execution privileges. Exploitation of this vulnerability requires user interaction.
How To Fix
Minimum fixed version
14-next:2023-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The vulnerability in platform/frameworks/base, allowing the start of a foreground activity from the background via MediaSession#setMediaButtonReceiver, poses a significant risk of local privilege escalation. It is crucial to update the affected package to the patched version to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to escalate their privileges on an affected Android device, potentially gaining unauthorized access to sensitive data or performing malicious actions.
Yes, user interaction is needed for the vulnerability to be exploited.
No, the vulnerability was introduced in version 14:0 and fixed in version 14:2023-11-01.
No, this vulnerability can only be exploited locally on the affected device.
No, there is currently no known workaround for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
