CVE-2024-43082: Android Frameworks Base - Cross-User Media Read Vulnerability in EditUserPhotoController
Summary
CVE-2024-43082: In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. Affects platform/frameworks/base across 2 version ranges.
>= 12:0, < 12:2024-11-01
>= 12L:0, < 12L:2024-11-01
Fixed in 12:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities and APIs for application development. It includes various libraries and services that facilitate user interactions and system operations. The EditUserPhotoController class is responsible for managing user profile photo updates, allowing users to select and modify their profile images. This package is critical for maintaining user identity and personalization within the Android ecosystem.
Vulnerability Detail
The vulnerability identified as CVE-2024-43082 arises from a flaw in the onActivityResult method of the EditUserPhotoController.java file. This issue is characterized as a possible cross-user media read due to a confused deputy, which means that an application could inadvertently access media files belonging to other users on the device. The ramifications of this vulnerability include local information disclosure, where sensitive user data could be exposed without requiring additional execution privileges or user interaction for exploitation. This poses a significant privacy risk, especially in multi-user environments.
How To Fix
Minimum fixed version
12:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to media files by adjusting the permissions of their applications or by using separate user profiles on the device to limit exposure to sensitive data until the patch is applied.
Conclusion
In summary, CVE-2024-43082 is a significant vulnerability within the Android Frameworks Base package that could lead to unauthorized access to user media files. It is crucial for developers and users to apply the necessary updates to mitigate this risk and protect user privacy.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-43082 is a vulnerability in the Android Frameworks Base package that allows for potential cross-user media read, leading to local information disclosure.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring access to the code.
The primary risk is the unauthorized access to media files belonging to other users, which can lead to privacy breaches and data exposure.
No, user interaction is not needed for exploitation, making it a more serious security concern.
If an immediate update is not possible, consider implementing workarounds such as restricting media access permissions or using separate user profiles.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
