CVE-2024-49740: Android Frameworks Base and Telephony Services Denial of Service Vulnerability
Summary
CVE-2024-49740: In multiple locations, there is a possible crash loop due to resource exhaustion. Affects platform/frameworks/base across 6 version ranges.
>= 12:0, < 12:2025-03-01
>= 12L:0, < 12L:2025-03-01
>= 13:0, < 13:2025-03-01
>= 14:0, < 14:2025-03-01
>= 15:0, < 15:2025-03-01
>= 15-next:0, < 15-next:2025-03-01
Fixed in 15-next:2025-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The affected packages, 'platform/frameworks/base' and 'platform/packages/services/Telephony', are integral components of the Android operating system. The frameworks provide essential functionalities for application development, while the Telephony services manage communication features such as SMS and call handling. This vulnerability exposes these packages to potential denial of service attacks, compromising the stability of devices running affected versions.
Vulnerability Detail
In multiple locations within the Android frameworks and Telephony services, a vulnerability exists that can lead to a crash loop due to resource exhaustion. This issue can be exploited without requiring additional execution privileges or user interaction, potentially resulting in a local denial of service. The vulnerability is particularly concerning as it affects core functionalities, making devices unresponsive and impacting user experience.
How To Fix
Minimum fixed version
15-next:2025-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the available patches as soon as possible to mitigate the risk.
Conclusion
The CVE-2024-49740 vulnerability poses a serious risk to Android devices by potentially causing denial of service through resource exhaustion. It is crucial for developers and users to apply the necessary patches to maintain device stability and security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-49740 is a vulnerability in the Android frameworks and Telephony services that can lead to a denial of service due to resource exhaustion.
Exploitation of this vulnerability can cause your device to enter a crash loop, making it unresponsive and affecting core functionalities.
No, user interaction is not needed for exploitation, making it a significant risk for devices running affected versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Ensure that you update the affected packages to the patched versions as soon as they are available to protect your application from this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
