CVE-2024-49744: Android Framework AccountManagerService Local Privilege Escalation Vulnerability
Summary
CVE-2024-49744: In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsafe deserialization. Affects platform/frameworks/base across 6 version ranges.
>= 12:0, < 12:2025-01-01
>= 12L:0, < 12L:2025-01-01
>= 13:0, < 13:2025-01-01
>= 14:0, < 14:2025-01-01
>= 15:0, < 15:2025-01-01
>= 15-next:0, < 15-next:2025-01-01
Fixed in 15-next:2025-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework is a set of APIs and tools that developers use to create applications for the Android operating system. It provides essential services such as account management, user interface design, and data storage. The AccountManagerService is responsible for managing user accounts and their authentication. This service is crucial for maintaining user security and privacy, but it is also a potential target for attackers seeking to exploit vulnerabilities that could lead to unauthorized access or privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2024-49744 exists in the checkKeyIntentParceledCorrectly function of AccountManagerService.java. It arises from unsafe deserialization, which allows an attacker to bypass parcel mismatch mitigation. This could lead to local escalation of privilege, enabling unauthorized actions without requiring additional execution privileges. User interaction is necessary for exploitation, making it a significant risk for users who may inadvertently trigger the vulnerability.
How To Fix
Minimum fixed version
15-next:2025-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to update to the patched versions as soon as they become available to mitigate the risk.
Conclusion
CVE-2024-49744 represents a significant security risk within the Android Framework's AccountManagerService due to unsafe deserialization. Users are strongly encouraged to update their systems to the patched versions to mitigate the risk of local privilege escalation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-49744 is a vulnerability in the Android Framework's AccountManagerService that allows local privilege escalation due to unsafe deserialization.
An attacker can exploit this vulnerability by tricking a user into interacting with a malicious application that triggers the unsafe deserialization process.
The potential consequences include unauthorized access to sensitive user data and the ability to perform actions that should be restricted to higher privilege levels.
Yes, patches are available for various versions of the Android Framework. Users should update to the latest versions as specified in the 'how to fix' section.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
