CVE-2024-40676
Published: 28 January 2025
Description
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-40676 is a vulnerability in the checkKeyIntent function of AccountManagerService.java within the Android Open Source Project's platform/frameworks/base component. It stems from a confused deputy issue (CWE-843) that allows bypassing intent security checks, enabling the installation of an unknown app. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and was published on 2025-01-28.
A local attacker requires no privileges, user interaction, or additional execution capabilities to exploit this issue. Exploitation results in local escalation of privilege, providing high impacts on confidentiality and integrity by allowing unauthorized app installation and privilege elevation on the affected device.
The Android Security Bulletin for October 2024 details the patch and mitigation steps at https://source.android.com/security/bulletin/2024-10-01. The specific fix is implemented in commit e8a53246607b52b15269f97aef9ba7e928ba2473, available at https://android.googlesource.com/platform/frameworks/base/+/e8a53246607b52b15269f97aef9ba7e928ba2473; practitioners should prioritize updating affected Android devices to versions incorporating this patch.
Details
- CWE(s)