CVE-2024-40654: Spoofing `getCallingPackage` or `getCallingActivity` with FLAG_ACTIVITY_FORWARD_RESULT
Summary
CVE-2024-40654: In multiple locations, there is a possible permission bypass due to a confused deputy. Affects platform/packages/apps/Settings across 5 version ranges.
>= 12:0, < 12:2024-09-01
>= 12L:0, < 12L:2024-09-01
>= 13:0, < 13:2024-09-01
>= 14:0, < 14:2024-09-01
>= 15-next:0, < 15-next:2024-09-01
Fixed in 15-next:2024-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/packages/apps/Settings in the Android ecosystem. This package is responsible for managing various settings and configurations on Android devices. It provides a user interface for users to customize their device settings, including network, display, sound, and security settings.
Vulnerability Detail
The vulnerability in platform/packages/apps/Settings allows for a possible permission bypass due to a confused deputy. This vulnerability can be exploited by an attacker to escalate their privileges locally without requiring any additional execution privileges. The exploitation of this vulnerability requires user interaction. The vulnerability is introduced in version 15-next:0 and is fixed in version 15-next:2024-09-01.
How To Fix
Minimum fixed version
15-next:2024-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is mentioned for this vulnerability.
Conclusion
The platform/packages/apps/Settings package in the Android ecosystem is vulnerable to a permission bypass vulnerability that can lead to local escalation of privilege. It is recommended to update to version 15-next:2024-09-01 or later to fix this vulnerability.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
The impact of this vulnerability is a possible local escalation of privilege. An attacker can exploit this vulnerability to gain elevated privileges on the affected device.
Yes, user interaction is needed for the successful exploitation of this vulnerability.
Versions 15-next:0 and earlier are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software.
No, there are no known workarounds for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
