CVE-2024-29779: platform/system/keymint - Device Protection Bypass Vulnerability
Summary
CVE-2024-29779: In multiple locations of legacy.rs, there is a possible bypass of device protection on the Attestation ID due to a logic error in the code. Affects platform/system/keymint across 2 version ranges.
>= 14:0, < 14:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Also tracked for
- :unknown: · Android
The same CVE-2024-29779 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'platform/system/keymint' package is a critical component of the Android ecosystem, responsible for managing cryptographic keys and ensuring secure operations related to device authentication and data protection. This package plays a vital role in maintaining the integrity and confidentiality of sensitive information on Android devices. However, it has been identified to have a vulnerability that could potentially compromise device security.
Vulnerability Detail
In multiple locations of legacy.rs, there exists a logic error that allows for a possible bypass of device protection on the Attestation ID. This flaw could enable local escalation of privilege, requiring system execution privileges for exploitation. Notably, user interaction is not necessary for an attacker to exploit this vulnerability, making it particularly concerning for device security.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2024-29779 vulnerability in the 'platform/system/keymint' package poses a significant risk due to its potential for local privilege escalation without user interaction. Immediate action is recommended to update the package to the patched version to ensure device security.
See every vulnerability recorded for platform/system/keymint →
FAQ
CVE-2024-29779 is a vulnerability in the 'platform/system/keymint' package that allows for a bypass of device protection due to a logic error, potentially leading to local escalation of privileges.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup required.
The vulnerability could allow unauthorized access to sensitive data and system functionalities, leading to a compromise of device security.
No, user interaction is not needed for exploitation, making it a serious concern for device security.
While there are no specific workarounds, it is crucial to monitor for updates and apply the patch as soon as possible to mitigate the risk.
