CVE-2024-47030: FPS FPC - Authentication Token Vulnerability in Android Pixel Family
Summary
CVE-2024-47030: ... Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-10-05. Fixed in Pixel-family specific:2024-10-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FPS FPC (Fingerprint Sensor Framework for Pixel Family) is an integral component of Android devices, specifically designed to manage fingerprint authentication. This framework allows users to securely unlock their devices and authorize transactions using their fingerprints. However, it has been identified that the framework can provide signed tokens without performing a necessary match, potentially exposing users to unauthorized access.
Vulnerability Detail
The vulnerability arises from the FPS FPC's failure to validate the authenticity of signed tokens before granting access. This oversight can lead to unauthorized users gaining access to sensitive information or functionalities, as the system does not adequately verify whether the token corresponds to a legitimate user. The implications of this vulnerability are significant, as it undermines the security model of fingerprint authentication, potentially allowing attackers to exploit this weakness for malicious purposes.
How To Fix
Minimum fixed version
Pixel-family specific:2024-10-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability until the patch is applied. Users are advised to refrain from using fingerprint authentication for sensitive transactions until their devices are updated.
Conclusion
In summary, CVE-2024-47030 is a significant vulnerability in the FPS FPC of Android devices that allows for unauthorized access due to improper token validation. Users are strongly encouraged to update their devices to the latest patched version to ensure their security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-47030 is a vulnerability in the FPS FPC of Android devices that allows signed tokens to be provided without proper authentication checks.
This vulnerability can potentially allow unauthorized access to your device, compromising sensitive information and functionalities.
If your device is affected, update to the patched version released on October 5, 2024, to secure your device against this vulnerability.
Currently, there are no workarounds available. It is recommended to avoid using fingerprint authentication for sensitive actions until the update is installed.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the gradle.lockfile. You can also check if your application is affected by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
