CVE-2024-40652: FRP Bypass in Settings App (Android 14)
Summary
CVE-2024-40652: In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. Affects platform/packages/apps/Settings across 5 version ranges.
>= 12:0, < 12:2024-09-01
>= 12L:0, < 12L:2024-09-01
>= 13:0, < 13:2024-09-01
>= 14:0, < 14:2024-09-01
>= 15-next:0, < 15-next:2024-09-01
Fixed in 15-next:2024-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Settings app is a core component of the Android operating system that allows users to configure various system settings. It provides a user-friendly interface for managing device preferences, network settings, security options, and more. The vulnerability identified in the Settings app allows unauthorized access to the app during device provisioning, potentially leading to privilege escalation. This vulnerability affects Android version 14 and below.
Vulnerability Detail
The vulnerability arises from a missing permission check in the onCreate method of the SettingsHomepageActivity.java file. This oversight enables an attacker to exploit the app during the device provisioning process, gaining unauthorized access to the Settings app. By leveraging this vulnerability, an attacker could escalate their privileges on the device without requiring any additional execution privileges. Exploitation of this vulnerability necessitates user interaction.
How To Fix
Minimum fixed version
15-next:2024-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the Settings app allows unauthorized access during device provisioning, potentially leading to privilege escalation. It is crucial for developers to apply the provided fix to ensure the security and integrity of the Android operating system. Users are advised to update their devices to the latest version to mitigate this vulnerability.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
The vulnerability allows unauthorized access to the Settings app during device provisioning, potentially leading to privilege escalation. However, exploitation of this vulnerability requires user interaction.
This vulnerability affects Android version 14 and below.
Yes, a fix for this vulnerability was implemented in the Android codebase on September 1, 2024.
You can find more information about this vulnerability in the Android Open Source Project (AOSP) database. Here is the link to the vulnerability details: https://storage.googleapis.com/android-osv/ASB-A-327749022.json
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
