CVE-2024-43095
Published: 21 January 2025
Description
In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Security Summary
CVE-2024-43095 is a logic error (CWE-203) present in multiple locations within Android components, enabling attackers to obtain any system permission. This vulnerability allows for local escalation of privilege without requiring additional execution privileges beyond basic local access. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on January 21, 2025.
A local attacker with low privileges (PR:L) can exploit this issue due to its low attack complexity (AC:L). Although the description notes that user interaction is needed for exploitation, the CVSS metrics indicate no user interaction (UI:N). Successful exploitation grants high confidentiality, integrity, and availability impacts, effectively providing full system-level control.
The Android Security Bulletin for January 2025 at https://source.android.com/security/bulletin/2025-01-01 provides details on affected versions and patches to mitigate this vulnerability. Security practitioners should apply the recommended updates promptly to Android devices.
Details
- CWE(s)