CVE-2024-34719: Bluetooth Module Permissions Bypass Vulnerability
Summary
CVE-2024-34719: In multiple locations, there is a possible permissions bypass due to a missing null check. Affects platform/packages/modules/Bluetooth across 3 version ranges.
>= 13:0, < 13:2024-11-01
>= 14:0, < 14:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Bluetooth module in the Android platform facilitates wireless communication between devices. It allows for data exchange and connection management, playing a crucial role in various applications, from file sharing to audio streaming. This module is integral to the Android ecosystem, enabling seamless connectivity and user interaction. However, it has been identified to have a permissions bypass vulnerability, which could potentially allow unauthorized access to sensitive functionalities.
Vulnerability Detail
The vulnerability arises from a missing null check in multiple locations within the Bluetooth module's codebase. This oversight can lead to a local escalation of privilege, allowing an attacker to gain unauthorized access without needing additional execution privileges. The exploitation of this vulnerability does not require user interaction, making it particularly concerning. The affected functions include permission checks related to location access, which are critical for Bluetooth operations. If exploited, this vulnerability could compromise user privacy and device security.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the available patches as soon as possible to mitigate the risk.
Conclusion
The CVE-2024-34719 vulnerability in the Android Bluetooth module poses a significant risk due to its potential for unauthorized access without user interaction. It is essential for users to update their devices to the latest patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
CVE-2024-34719 is a vulnerability in the Android Bluetooth module that allows for a permissions bypass due to a missing null check, potentially leading to unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary risk is local escalation of privilege, which could allow unauthorized access to sensitive functionalities, potentially compromising user privacy.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
If you cannot update your device, it is crucial to limit the use of Bluetooth functionalities until a patch is applied or consider using alternative devices that are not affected.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
