CVE-2024-0020: Reveal audios across users via com.android.settings.notification.app.NotificationSoundPreference
Summary
CVE-2024-0020: In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. Affects platform/packages/apps/Settings across 6 version ranges.
>= 11:0, < 11:2024-01-01
>= 12:0, < 12:2024-01-01
>= 12L:0, < 12L:2024-01-01
>= 13:0, < 13:2024-01-01
>= 14:0, < 14:2024-01-01
>= 14-next:0, < 14-next:2024-01-01
Fixed in 14-next:2024-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is com.android.settings.notification.app.NotificationSoundPreference, which is a component of the Android Settings app. This app provides users with access to various system settings and preferences on their Android devices. The NotificationSoundPreference component specifically handles the selection of notification sounds for different apps. It allows users to choose from a list of available audio files or browse their device's storage for custom sound files. However, a vulnerability has been identified in the component that could potentially expose audio files belonging to a different user on the same device.
Vulnerability Detail
The vulnerability exists in the onActivityResult function of the NotificationSoundPreference.java file. Due to a confused deputy scenario, it is possible for an attacker to exploit this vulnerability and listen to audio files that belong to a different user on the device. This can occur without requiring any additional execution privileges or user interaction. The issue arises from a lack of proper validation and authorization checks when handling the selection of notification sounds. As a result, an attacker can bypass the intended restrictions and gain unauthorized access to audio files from other users on the device. This vulnerability poses a significant risk as it can lead to local information disclosure across users.
How To Fix
Minimum fixed version
14-next:2024-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding the selection of notification sounds from untrusted sources or unknown users. It is advisable to stick to the default notification sounds provided by the system or choose from trusted sources.
Conclusion
The vulnerability in com.android.settings.notification.app.NotificationSoundPreference exposes audio files across users on an Android device. It can be exploited without requiring additional execution privileges or user interaction. To mitigate this risk, developers should implement the recommended fixes and users should exercise caution when selecting notification sounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
com.android.settings.notification.app.NotificationSoundPreference is a component of the Android Settings app that handles the selection of notification sounds for different apps on an Android device.
The vulnerability allows an attacker to bypass validation and authorization checks, enabling them to access audio files belonging to other users on the same device.
No, user interaction is not required for the exploitation of this vulnerability.
The vulnerability can lead to local information disclosure across users of a device, allowing an attacker to listen to audio files that belong to different users.
Yes, developers can fix this vulnerability by implementing proper validation and authorization checks in the affected code. It is also recommended to update the Android Settings app to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
