CVE-2024-0025: BG-FGS restrictions bypass in platform/frameworks/base
Summary
CVE-2024-0025: In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-05-01
>= 12L:0, < 12L:2024-05-01
>= 13:0, < 13:2024-05-01
>= 14:0, < 14:2024-05-01
>= 14-next:0, < 14-next:2024-05-01
Fixed in 14-next:2024-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package platform/frameworks/base is a critical component of the Android operating system. It provides fundamental functionalities and APIs for various system services and applications. This package is responsible for managing activities, intents, and permissions, among other essential system operations. However, a vulnerability has been discovered in this package that allows for the bypass of BG-FGS (Background Freeze and Greylist Restrictions) restrictions.
Vulnerability Detail
The vulnerability (CVE-2024-0025) originates in the sendIntentSender method of ActivityManagerService.java. Due to a logic error, it is possible to launch a background activity, leading to a local escalation of privilege. This means that an attacker can exploit this vulnerability to gain elevated privileges without requiring any additional execution privileges. Notably, user interaction is not necessary for the exploitation of this vulnerability. The impact of this vulnerability can be severe, as it allows an attacker to perform unauthorized actions and potentially compromise the integrity and confidentiality of the affected system.
How To Fix
Minimum fixed version
14-next:2024-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability (CVE-2024-0025) in the platform/frameworks/base package allows for the bypass of BG-FGS restrictions, leading to a local escalation of privilege. It is crucial to apply the provided patches to fix this vulnerability and prevent unauthorized actions and potential compromise of system integrity and confidentiality. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is a local escalation of privilege, allowing an attacker to gain elevated privileges without requiring additional execution privileges. This can lead to unauthorized actions and potential compromise of system integrity and confidentiality.
No, user interaction is not needed for the exploitation of this vulnerability.
The vulnerability affects Android versions 12, 12L, 13, and 14.
There are no known instances of this vulnerability being exploited in the wild.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your application without requiring any signup or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
