CVE-2024-40662: Bypass Vulnerability in platform/frameworks/base
Summary
CVE-2024-40662: In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-09-01
>= 12L:0, < 12L:2024-09-01
>= 13:0, < 13:2024-09-01
>= 14:0, < 14:2024-09-01
>= 15-next:0, < 15-next:2024-09-01
Fixed in 15-next:2024-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'platform/frameworks/base' is a part of the Android ecosystem and is responsible for providing core functionalities and services to the Android operating system. It includes various components and libraries that are essential for the functioning of the Android framework. This package is vulnerable to a bypass vulnerability that allows for the creation of a malformed Uri object due to improper input validation.
Vulnerability Detail
The bypass vulnerability in 'platform/frameworks/base' allows an attacker to craft a specially crafted Uri object that can bypass the proper input validation. This can lead to a local escalation of privilege without requiring any additional execution privileges. The vulnerability does not require user interaction for exploitation. The impact of this vulnerability can vary depending on the context in which the Uri object is used, but it has the potential to be exploited for malicious purposes.
How To Fix
Minimum fixed version
15-next:2024-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section to address the vulnerability.
Conclusion
The 'platform/frameworks/base' package in the Android ecosystem is vulnerable to a bypass vulnerability that allows for the creation of a malformed Uri object. This vulnerability can be exploited for local escalation of privilege without requiring additional execution privileges. It is important to update the package to the fixed version to mitigate the risk of exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability can vary depending on the context in which the Uri object is used. It has the potential to be exploited for local escalation of privilege, allowing an attacker to gain elevated privileges on the affected system.
No, user interaction is not required for exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including this one, using the gradle.lockfile.
If your application is affected by this vulnerability, it is recommended to update the 'platform/frameworks/base' package to the fixed version mentioned in the 'how_to_fix' section. Regularly updating the Android framework is important to ensure the latest security patches and fixes are applied.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
