CVE-2024-40657: Account preference allows secondary user to manage app restriction on system user
Summary
CVE-2024-40657: In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. Affects platform/packages/apps/Settings across 5 version ranges.
>= 12:0, < 12:2024-09-01
>= 12L:0, < 12L:2024-09-01
>= 13:0, < 13:2024-09-01
>= 14:0, < 14:2024-09-01
>= 15-next:0, < 15-next:2024-09-01
Fixed in 15-next:2024-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/packages/apps/Settings in the Android ecosystem. This package is responsible for managing various settings and preferences on an Android device. It provides a user interface for users to configure system settings, including account preferences. The AccountTypePreferenceLoader.java file within this package handles the loading and management of account preferences. These preferences allow users to customize app restrictions for different types of accounts on the device.
Vulnerability Detail
The vulnerability exists in the addPreferencesForType function of AccountTypePreferenceLoader.java. Due to a confused deputy issue, a secondary user can manipulate app restrictions for the system user. This can lead to a local escalation of privilege without requiring additional execution privileges. Exploitation of this vulnerability does not require user interaction. The issue arises from a lack of proper validation and authorization checks, allowing unauthorized users to modify app restrictions for the system user.
How To Fix
Minimum fixed version
15-next:2024-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the platform/packages/apps/Settings package in the Android ecosystem is vulnerable to a local escalation of privilege. The addPreferencesForType function in AccountTypePreferenceLoader.java allows a secondary user to manipulate app restrictions for the system user. This vulnerability can be mitigated by applying the provided fix from the Android Open Source Project.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
The impact of this vulnerability is a local escalation of privilege, allowing a secondary user to manipulate app restrictions for the system user.
No, exploitation of this vulnerability does not require user interaction.
The root cause of this vulnerability is a lack of proper validation and authorization checks in the addPreferencesForType function of AccountTypePreferenceLoader.java.
There are no known instances of this vulnerability being exploited at the time of this report.
Yes, a fix has been provided by the Android Open Source Project. It is recommended to apply the fix to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
