CVE-2024-40672
Published: 28 January 2025
Description
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-40672 is a vulnerability in the onCreate method of ChooserActivity.java within Android's IntentResolver component, located in platform/packages/modules/IntentResolver. The issue stems from a missing permission check, enabling attackers to bypass factory reset protections. This flaw results in local escalation of privilege and is rated at CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-281 (Improper Preservation of Permissions).
A local attacker with no privileges (PR:N) can exploit this vulnerability without user interaction (UI:N) or additional execution privileges. By targeting the affected ChooserActivity, the attacker achieves high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), potentially gaining elevated access on the device and circumventing factory reset safeguards.
The Android Security Bulletin for October 2024 (https://source.android.com/security/bulletin/2024-10-01) documents this vulnerability and recommends updating to patched Android versions. A specific upstream patch is available at https://android.googlesource.com/platform/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727, which addresses the missing permission check.
Details
- CWE(s)