CVE-2024-43088: Android Settings App Local Privilege Escalation Vulnerability
Summary
CVE-2024-43088: In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missing permission check. Affects platform/packages/apps/Settings across 5 version ranges.
>= 12:0, < 12:2024-11-01
>= 12L:0, < 12L:2024-11-01
>= 13:0, < 13:2024-11-01
>= 14:0, < 14:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Settings application is a core component of the Android operating system, responsible for managing device settings and configurations. It provides users with a user-friendly interface to adjust system preferences, manage applications, and control device functionalities. This vulnerability affects the Settings app, specifically in the AppInfoBase.java file, where a missing permission check allows for potential manipulation of app permission settings across user boundaries.
Vulnerability Detail
In multiple functions within AppInfoBase.java, there exists a flaw that allows for the manipulation of app permission settings belonging to other users on the device. This vulnerability arises from a lack of proper permission checks, enabling local escalation of privilege without requiring additional execution privileges or user interaction. The implications of this vulnerability are significant, as it could allow malicious users to alter settings and permissions of applications that do not belong to them, potentially compromising user data and privacy.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to update to the patched version as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2024-43088 represents a significant local privilege escalation vulnerability in the Android Settings application, stemming from inadequate permission checks. Users are urged to update to the latest version to safeguard their devices against potential exploitation.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
CVE-2024-43088 is a vulnerability in the Android Settings application that allows local privilege escalation due to a missing permission check.
This vulnerability can allow unauthorized users to manipulate app permissions of other users on the device, potentially compromising user privacy and security.
Devices running affected versions of the Android Settings application (prior to 12.2024-11-01) are at risk. It is advisable to check for updates.
The best way to protect your device is to update the Android Settings application to the patched version as soon as it is available.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
