CVE-2024-40669
Published: 28 January 2025
Description
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-40669 is a use-after-free vulnerability stemming from a race condition in TBD of TBD. It affects Android systems, as documented in the October 2024 Android security bulletin.
A local attacker with no privileges required can exploit this vulnerability without user interaction to achieve local escalation of privilege. The attack has low complexity and results in high impacts to confidentiality, integrity, and availability, reflected in its CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is mapped to CWE-416 (Use After Free).
The Android security bulletin at https://source.android.com/security/bulletin/2024-10-01 details available patches and mitigation recommendations for affected devices.
Details
- CWE(s)