CVE-2024-0019: Open Source Vulnerability in platform/frameworks/base - Record audio without showing a microphone privacy indicator due to restart app systemui
Summary
CVE-2024-0019: In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-01-01
>= 12L:0, < 12L:2024-01-01
>= 13:0, < 13:2024-01-01
>= 14:0, < 14:2024-01-01
>= 14-next:0, < 14-next:2024-01-01
Fixed in 14-next:2024-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base, which is a part of the Android ecosystem. It provides fundamental functionality and services for the Android operating system. This package is responsible for managing various system components, including the user interface, system services, and resource management. It plays a crucial role in the overall functioning of the Android system.
Vulnerability Detail
The vulnerability identified as CVE-2024-0019 allows for the recording of audio without displaying the microphone privacy indicator when restarting the systemUI. This vulnerability arises due to a missing check for active recordings in the setListening function of AppOpsControllerImpl.java. An attacker can exploit this vulnerability to perform a local denial of service attack without requiring additional execution privileges. However, user interaction is necessary for successful exploitation. The absence of the microphone privacy indicator can lead to unauthorized audio recording, compromising user privacy and potentially facilitating malicious activities.
How To Fix
Minimum fixed version
14-next:2024-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually disable the microphone permission for any suspicious or untrusted applications. This can be done by navigating to the 'App Permissions' section in the device settings and revoking the microphone permission for the respective applications. However, this workaround may impact the functionality of legitimate applications that require microphone access.
Conclusion
The vulnerability in platform/frameworks/base allows for audio recording without displaying the microphone privacy indicator, posing a significant risk to user privacy. It is crucial to apply the provided fix by updating the affected package to the latest version. Regularly updating the Android operating system is essential to ensure the installation of security patches and protect against potential vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows for audio recording without displaying the microphone privacy indicator, compromising user privacy and potentially facilitating unauthorized surveillance or malicious activities.
Yes, user interaction is necessary for successful exploitation of this vulnerability.
The severity of this vulnerability is classified as High.
No, the vulnerability was introduced in Android version 12 and remains unfixed until version 14.
Yes, the Android platform developers have released a fix for this vulnerability. Updating the platform/frameworks/base package to the latest version will address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
