CVE-2024-0026: Permanent device denial of service due to a huge amount of scheduled alarms in platform/frameworks/base
Summary
CVE-2024-0026: In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-04-01
>= 12L:0, < 12L:2024-04-01
>= 13:0, < 13:2024-04-01
>= 14:0, < 14:2024-04-01
>= 14-next:0, < 14-next:2024-04-01
Fixed in 14-next:2024-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android ecosystem. It provides core functionalities and services for the Android operating system. This package is responsible for managing various system resources and providing essential APIs for application development. It is widely used by Android devices and plays a crucial role in the overall functioning of the system.
Vulnerability Detail
The vulnerability identified as CVE-2024-0026 in the platform/frameworks/base package can result in a permanent denial of service on the affected device. The issue arises due to a flaw in the SnoozeHelper.java file, specifically in multiple functions. Attackers can exploit this vulnerability to exhaust system resources by scheduling a large number of alarms. As a result, the device becomes unresponsive and experiences a local denial of service. The exploitation does not require any additional execution privileges or user interaction.
How To Fix
Minimum fixed version
14-next:2024-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability identified as CVE-2024-0026 in the platform/frameworks/base package can result in a permanent denial of service on the affected Android device. It is crucial to apply the provided patch to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability can lead to a permanent denial of service on the affected Android device, rendering it unresponsive and causing disruption to the user.
No, user interaction is not needed for exploitation. Attackers can exploit the vulnerability without any user involvement.
No, the vulnerability affects versions 12, 12L, 13, and 14 of the Android ecosystem. Earlier versions are not impacted.
Yes, a fix has been provided by the Android team. It is recommended to update the affected package to a version that includes the fix.
You can find more information about this vulnerability in the official Android Open Source Project Security Bulletin: https://storage.googleapis.com/android-osv/ASB-A-308414141.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
