CVE-2024-40676: Android AccountManagerService Intent Check Bypass Vulnerability
Summary
CVE-2024-40676: In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-10-01
>= 12L:0, < 12L:2024-10-01
>= 13:0, < 13:2024-10-01
>= 14:0, < 14:2024-10-01
>= 15-next:0, < 15-next:2024-10-01
Fixed in 15-next:2024-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android framework's AccountManagerService is responsible for managing user accounts and facilitating authentication processes. It provides a secure interface for applications to access account information while ensuring user privacy and data protection. However, a vulnerability has been identified in the checkKeyIntent method, which could allow malicious applications to bypass security checks, leading to unauthorized app installations.
Vulnerability Detail
In the checkKeyIntent method of AccountManagerService.java, there exists a flaw that enables a potential bypass of the intent security check. This vulnerability arises from a confused deputy problem, where an application could exploit the system to install unknown apps without user consent. The implications of this vulnerability are severe, as it could lead to local escalation of privileges, allowing attackers to execute malicious code with the same permissions as the affected application. No additional execution privileges are required, and user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
15-next:2024-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability other than updating to the patched version. Users are advised to regularly check for system updates to ensure their devices are secure.
Conclusion
The CVE-2024-40676 vulnerability in the Android AccountManagerService poses a significant risk by allowing unauthorized app installations through a bypass of intent security checks. It is crucial for users and developers to update their systems to the patched version to mitigate this risk. Regular monitoring and updates are essential for maintaining security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-40676 is a vulnerability in the Android AccountManagerService that allows bypassing intent security checks, potentially leading to unauthorized app installations.
Devices running Android version 12 or later prior to the patch release on 2024-10-01 are at risk. You can check your device's version in the settings under 'About Phone'.
If your device is affected, you should update to the latest version of the Android framework as soon as possible to patch the vulnerability.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
