CVE-2024-0017: Camera2 - Access to user location without any permissions
Summary
CVE-2024-0017: In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. Affects platform/packages/apps/Camera2 across 6 version ranges.
>= 11:0, < 11:2024-01-01
>= 12:0, < 12:2024-01-01
>= 12L:0, < 12L:2024-01-01
>= 13:0, < 13:2024-01-01
>= 14:0, < 14:2024-01-01
>= 14-next:0, < 14-next:2024-01-01
Fixed in 14-next:2024-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Camera2 is an Android package that provides camera functionality to applications. It allows users to capture photos and videos using their device's camera. This package is a part of the Android ecosystem and is present in versions 11 and above. However, a vulnerability has been identified in Camera2 that allows access to the user's location without any permissions.
Vulnerability Detail
The vulnerability exists in the shouldUseNoOpLocation function of the CameraActivity.java file. It is possible to bypass permissions and exploit a confused deputy scenario, leading to the disclosure of local information. This vulnerability does not require any additional execution privileges and can be exploited with user interaction. The impact of this vulnerability is the potential disclosure of the user's location without their consent.
How To Fix
Minimum fixed version
14-next:2024-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Camera2 package in Android versions 11 and above is vulnerable to a permissions bypass issue that allows access to the user's location without any permissions. This can lead to the disclosure of sensitive information. It is recommended to update the package to the provided fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Camera2 →
FAQ
The impact of this vulnerability is the potential disclosure of the user's location without their consent.
Versions 11 and above of the Camera2 package are affected by this vulnerability.
Yes, user interaction is needed for exploitation of this vulnerability.
Yes, a fix has been provided by updating the Camera2 package to version 5c4c4b35754eef319dcd69c422f0b1ac0c823f6e or later.
No specific workaround has been mentioned for this vulnerability.
