CVE-2024-43764
Published: 03 January 2025
Description
In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-43764 is a vulnerability in the onPrimaryClipChanged method of ClipboardListener.java within the Android Open Source Project's frameworks/base component. It enables a partial bypass of the lock screen, potentially leading to local escalation of privilege. No additional execution privileges or user interaction are required for exploitation. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this issue with low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing the attacker to elevate privileges on the device.
The Android security bulletin for December 2024 details the issue and provides mitigation through an upstream patch, available at the commit https://android.googlesource.com/platform/frameworks/base/+/70eb75df7d342429c3ee225feb7c011df727442f. Security practitioners should apply the relevant Android updates to address this vulnerability.
Details
- CWE(s)