CVE-2024-0024: Open Source Vulnerability in platform/frameworks/base
Summary
CVE-2024-0024: In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-05-01
>= 12L:0, < 12L:2024-05-01
>= 13:0, < 13:2024-05-01
>= 14:0, < 14:2024-05-01
>= 14-next:0, < 14-next:2024-05-01
Fixed in 14-next:2024-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'platform/frameworks/base' is a part of the Android ecosystem and is responsible for providing fundamental functionality and services to the Android operating system. It includes various components and APIs that enable the development and execution of Android applications. This package is vulnerable to a specific issue that allows the creation and persistence of a new secondary user without any restrictions via a super large seed account type.
Vulnerability Detail
The vulnerability exists in multiple methods of UserManagerService.java within the 'platform/frameworks/base' package. Due to improper input validation, there is a possibility of failure to persist or enforce user restrictions. This vulnerability can be exploited locally to escalate privileges without requiring additional execution privileges. However, user interaction is necessary for successful exploitation. The impact of this vulnerability can lead to unauthorized access and potential misuse of user accounts and data.
How To Fix
Minimum fixed version
14-next:2024-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The 'platform/frameworks/base' package in the Android ecosystem is vulnerable to a privilege escalation issue that allows the creation of a new secondary user without any restrictions. This vulnerability can be fixed by applying the provided fix from the official Android source repository. It is recommended to update the affected package to a version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows the creation of a new secondary user without any restrictions, potentially leading to unauthorized access and misuse of user accounts and data.
Yes, user interaction is necessary for successful exploitation of this vulnerability.
The vulnerability affects Android versions 12, 12L, 13, and 14.
Yes, a fix has been released and is available in the official Android source repository.
The severity of this vulnerability is classified as High.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
