CVE-2024-43084: Android Framework Base Package Information Disclosure Vulnerability
Summary
CVE-2024-43084: In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-11-01
>= 12L:0, < 12L:2024-11-01
>= 13:0, < 13:2024-11-01
>= 14:0, < 14:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Framework Base package is a core component of the Android operating system, providing essential functionalities for app development and system operations. It includes various classes and methods that facilitate user interface design, notifications, and interactions with system resources. This package is critical for the stability and security of Android applications, making it imperative to address any vulnerabilities that may arise.
Vulnerability Detail
The vulnerability identified as CVE-2024-43084 exists in the 'visitUris' method across multiple files within the Android Framework Base package. It is characterized as a confused deputy problem, which can lead to local information disclosure without requiring additional execution privileges. This means that sensitive information could potentially be exposed to unauthorized users, posing a significant security risk. The vulnerability does not require user interaction for exploitation, making it particularly concerning for developers and users alike.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
In summary, CVE-2024-43084 is a significant vulnerability affecting the Android Framework Base package, which can lead to local information disclosure. It is essential for developers to update their packages to the latest patched versions to protect against potential exploitation. Monitoring tools like Vulert can assist in real-time vulnerability detection.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-43084 is a vulnerability in the Android Framework Base package that allows for potential local information disclosure due to a confused deputy issue.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The consequences include the potential exposure of sensitive information to unauthorized users, which could lead to privacy breaches and security risks.
No, user interaction is not needed for exploitation, making it a critical concern for application security.
While no specific workaround is available, it is crucial to prioritize updating to the patched version as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
