In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
| Link | Resource |
|---|---|
| https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede | Mailing List Patch |
| https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede | Mailing List Patch |
| https://source.android.com/security/bulletin/2024-03-01 | Patch Vendor Advisory |
| https://source.android.com/security/bulletin/2024-03-01 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Dec 2024, 19:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://source.android.com/security/bulletin/2024-03-01 - Patch, Vendor Advisory | |
| References | () https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede - Mailing List, Patch | |
| First Time |
Google android
|
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* |
11 Mar 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-11 17:15
Updated : 2024-12-16 19:47
NVD link : CVE-2024-0048
Mitre link : CVE-2024-0048
JSON object : View
Products Affected
- android
CWE