CVE-2024-40660: Android Frameworks Native Package Local Privilege Escalation Vulnerability
Summary
CVE-2024-40660: In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. Affects platform/frameworks/native across 3 version ranges.
>= 14:0, < 14:2024-11-01
>= 15:0, < 15:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Native package is a core component of the Android operating system, responsible for managing low-level system services and hardware interactions. It plays a crucial role in rendering graphics and managing display attributes. This package is integral to the functionality of Android devices, providing essential services that ensure smooth operation and user experience. However, like any software, it is susceptible to vulnerabilities that can compromise system integrity and security.
Vulnerability Detail
In the SurfaceFlinger.cpp file, the vulnerability arises from a logic error in the setTransactionState function. This flaw allows an attacker to change protected display attributes without requiring additional execution privileges or user interaction. The potential ramifications include local escalation of privileges, which could enable unauthorized access to sensitive system functions or data, thereby compromising the overall security of the device.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive system functions or limit the execution of applications that may exploit this vulnerability until the package is updated. Additionally, monitoring system logs for unusual activity may help identify potential exploitation attempts.
Conclusion
The CVE-2024-40660 vulnerability in the Android Frameworks Native package poses a significant risk of local privilege escalation. Users are strongly advised to update to the latest patched versions to mitigate this risk. For those unable to update immediately, implementing temporary workarounds can help protect against potential exploitation.
See every vulnerability recorded for platform/frameworks/native →
FAQ
CVE-2024-40660 is a vulnerability in the Android Frameworks Native package that allows local privilege escalation due to a logic error in the setTransactionState function.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. No signup is required.
The vulnerability can lead to unauthorized access to sensitive system functions, potentially compromising device security and user data.
Yes, a patch is available in the updated versions of the Android Frameworks Native package. Users should update to '15-next:2024-11-01' or '14:2024-11-01'.
If you cannot update immediately, consider restricting access to sensitive functions and monitoring system logs for any unusual activity.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/native.
