CVE-2024-49720: Android Permission Module Local Privilege Escalation Vulnerability
Summary
CVE-2024-49720: In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. Affects platform/packages/modules/Permission across 4 version ranges.
>= 13:0, < 13:2025-04-01
>= 14:0, < 14:2025-04-01
>= 15:0, < 15:2025-04-01
>= 15-next:0, < 15-next:2025-04-01
Fixed in 15-next:2025-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Permission module is a core component of the Android operating system that manages user permissions for applications. It ensures that apps request and obtain the necessary permissions to access sensitive user data and device features. This module is crucial for maintaining user privacy and security, as it controls which apps can access specific functionalities based on user consent. However, a logic error in the Permissions.java file has introduced a vulnerability that could allow unauthorized changes to user location permissions.
Vulnerability Detail
In multiple functions of Permissions.java, there exists a logic error that may allow an attacker to override the state of the user's location permissions. This vulnerability can lead to local escalation of privilege without requiring additional execution privileges or user interaction. The flaw arises from improper handling of permission states, which could be exploited to grant unauthorized access to location data, posing significant risks to user privacy and security.
How To Fix
Minimum fixed version
15-next:2025-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can manually review and adjust app permissions in the device settings to ensure that location permissions are set correctly. However, this does not fully mitigate the risk associated with the vulnerability.
Conclusion
The CVE-2024-49720 vulnerability in the Android Permission module poses a significant risk of local privilege escalation, allowing unauthorized changes to user location permissions. It is crucial for developers to update their applications to the patched versions to mitigate this risk and protect user privacy.
See every vulnerability recorded for platform/packages/modules/Permission →
FAQ
CVE-2024-49720 is a vulnerability in the Android Permission module that allows unauthorized changes to user location permissions due to a logic error in the code.
Exploitation of this vulnerability could lead to unauthorized access to sensitive user location data, compromising user privacy and security.
Versions 13, 14, and 15 of the Android Permission module are affected by this vulnerability.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner to use the Vulert playground without signup.
Update your Android Permission module to the latest patched version as specified in the 'how to fix' section to secure your application against this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Permission.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
