CVE-2024-40661: Android Permission Module Local Privilege Escalation Vulnerability
Summary
CVE-2024-40661: In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. Affects platform/packages/modules/Permission across 5 version ranges.
>= 12:0, < 12:2024-11-01
>= 12L:0, < 12L:2024-11-01
>= 13:0, < 13:2024-11-01
>= 14:0, < 14:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Permission module is a critical component of the Android operating system, responsible for managing app permissions and ensuring that applications only access the resources they are authorized to use. This module plays a vital role in maintaining user privacy and security by enforcing permission checks. However, a recent vulnerability has been identified that could allow unauthorized access to sensitive features, such as the microphone, due to insufficient permission checks.
Vulnerability Detail
In the mayAdminGrantPermission function of AdminRestrictedPermissionsUtils.java, there exists a flaw that allows for potential access to the device's microphone without proper permission verification. This vulnerability can lead to local escalation of privilege, enabling an attacker to exploit the system without requiring additional execution privileges or user interaction. The issue arises from a missing permission check, which could be exploited by malicious applications or users with administrative access.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the permissions granted to applications or disable microphone access in the device settings until the patch is applied. Additionally, reviewing and limiting the administrative privileges of applications can help mitigate the risk of exploitation.
Conclusion
The CVE-2024-40661 vulnerability in the Android Permission module poses a significant risk by allowing unauthorized access to the microphone. It is crucial for users and developers to apply the necessary updates to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring better security for applications.
See every vulnerability recorded for platform/packages/modules/Permission →
FAQ
CVE-2024-40661 is a vulnerability in the Android Permission module that allows unauthorized access to the microphone due to a missing permission check.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your gradle.lockfile for vulnerabilities without requiring any signup.
The vulnerability could lead to unauthorized access to the microphone, allowing malicious applications to eavesdrop on users without their consent.
Yes, a patch is available in version 15-next:2024-11-01 of the Android Permission module. Users should update to this version or later.
If immediate updates are not possible, consider restricting app permissions and disabling microphone access in your device settings as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Permission.
