CVE-2024-0015: Launch Anywhere via Screen Saver on Pixel 6 Pro with Android 12L
Summary
CVE-2024-0015: In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. Affects platform/frameworks/base across 5 version ranges.
>= 11:0, < 11:2024-01-01
>= 12:0, < 12:2024-01-01
>= 12L:0, < 12L:2024-01-01
>= 13:0, < 13:2024-01-01
>= 14-next:0, < 14-next:2024-01-01
Fixed in 14-next:2024-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package is responsible for providing the fundamental building blocks and essential functionalities for the Android operating system. It includes various components such as activity and service management, resource handling, and user interface rendering. The vulnerability affects versions 11, 12, 12L, and 13 of Android. The package is vulnerable to a privilege escalation vulnerability that allows arbitrary protected activities to be launched through intent redirection. This vulnerability requires local execution privileges, and user interaction is not necessary for exploitation.
Vulnerability Detail
The vulnerability, identified as CVE-2024-0015, originates from the convertToComponentName function in DreamService.java. Due to intent redirection, an attacker can exploit this vulnerability to launch arbitrary protected activities. This can lead to a local escalation of privilege, allowing the attacker to gain higher execution privileges on the affected device. The vulnerability requires the attacker to have user execution privileges, but it does not rely on user interaction for exploitation.
How To Fix
Minimum fixed version
14-next:2024-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the vulnerability CVE-2024-0015 allows for the launch of arbitrary protected activities through intent redirection, leading to a local escalation of privilege on Pixel 6 Pro devices running Android 12L. It is crucial to apply the provided fix or update to a fixed version of Android to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to escalate their privileges on the affected device, potentially gaining access to sensitive data or performing unauthorized actions.
Versions 11, 12, 12L, and 13 of Android are affected by this vulnerability.
No, user interaction is not required for the exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild.
Yes, a fix has been provided by the Android Open Source Project (AOSP). It is recommended to update the affected Android version to a fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
