CVE-2024-49724: Android Framework AccountManagerService Race Condition Vulnerability
Summary
CVE-2024-49724: In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a race condition. Affects platform/frameworks/base across 6 version ranges.
>= 12:0, < 12:2025-01-01
>= 12L:0, < 12L:2025-01-01
>= 13:0, < 13:2025-01-01
>= 14:0, < 14:2025-01-01
>= 15:0, < 15:2025-01-01
>= 15-next:0, < 15-next:2025-01-01
Fixed in 15-next:2025-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework is a comprehensive software stack that provides the necessary tools and APIs for building Android applications. It includes various services, one of which is the AccountManagerService, responsible for managing user accounts and authentication. This service plays a crucial role in ensuring secure access to user data and applications. However, a race condition vulnerability has been identified in the AccountManagerService, which could potentially allow unauthorized access to protected activities.
Vulnerability Detail
In multiple functions of AccountManagerService.java, there exists a race condition that may allow an attacker to bypass permissions and launch protected activities. This vulnerability can lead to local escalation of privilege without requiring additional execution privileges. Exploitation of this vulnerability necessitates user interaction, making it a significant concern for user security and data integrity.
How To Fix
Minimum fixed version
15-next:2025-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of applications that rely on the AccountManagerService until the package is updated. Additionally, users should be cautious about granting permissions to apps that request access to sensitive account information.
Conclusion
The CVE-2024-49724 vulnerability in the Android Framework's AccountManagerService poses a significant risk due to a race condition that can lead to unauthorized access. It is crucial for users to update their systems to the patched versions to mitigate this risk. Awareness and proactive measures can help safeguard user data and maintain application integrity.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-49724 is a vulnerability in the Android Framework's AccountManagerService that allows for a potential bypass of permissions due to a race condition.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring access to the code or installation.
The primary risk is local escalation of privilege, which could allow unauthorized access to protected activities and sensitive user data.
Yes, patches are available in specific versions of the Android Framework. Users should update to versions 15-next:2025-01-01, 12:2025-01-01, 13:2025-01-01, or 14:2025-01-01.
If immediate updates are not possible, limit the use of applications that utilize the AccountManagerService and be cautious about granting permissions.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
