CVE-2024-40659: AndroidKeyStore Key Generation Feature Disabling in RemoteKeyProvisioning
Summary
CVE-2024-40659: In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input... Affects platform/frameworks/base versions >= 15-next:0, < 15-next:2024-09-01. Fixed in 15-next:2024-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RemoteKeyProvisioning package in the Android ecosystem is responsible for handling remote key provisioning for Android devices. It allows apps to generate and manage cryptographic keys securely. The AndroidKeyStore is a key management system that provides secure storage and retrieval of cryptographic keys. It ensures that keys are protected and cannot be extracted from the device. However, a vulnerability has been discovered in the RemoteKeyProvisioning package that allows an attacker to disable the AndroidKeyStore key generation feature permanently.
Vulnerability Detail
The vulnerability exists in the getRegistration function of the RemoteProvisioningService.java file. Due to improper input validation, an attacker can update the attestation keys of all installed apps, which leads to the permanent disabling of the AndroidKeyStore key generation feature. This vulnerability can be exploited locally without requiring any additional execution privileges or user interaction. The impact of this vulnerability is a local denial of service, rendering the AndroidKeyStore key generation feature unusable.
How To Fix
Minimum fixed version
15-next:2024-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fixes to address the issue.
Conclusion
The vulnerability in the RemoteKeyProvisioning package allows an attacker to permanently disable the AndroidKeyStore key generation feature. This can lead to a local denial of service. It is crucial to update the affected packages to mitigate the vulnerability.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is a local denial of service, as it permanently disables the AndroidKeyStore key generation feature.
No, this vulnerability can only be exploited locally.
No, user interaction is not needed for exploitation of this vulnerability.
The RemoteKeyProvisioning package and the Permission package in the Android ecosystem are affected.
Yes, fixes for the RemoteKeyProvisioning package and the Permission package have been provided. It is recommended to update to the latest versions of these packages.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
