ASB-A-327749022
See a problem?- Import Source
- https://storage.googleapis.com/android-osv/ASB-A-327749022.json
- JSON Data
- https://api.osv.dev/v1/vulns/ASB-A-327749022
- Aliases
-
- A-327749022
- CVE-2024-40652
- Published
- 2024-09-01T00:00:00Z
- Modified
- 2024-09-05T15:27:10.150893Z
- Summary
- (Split 5) (Step 27) - FRP Bypass January 2024 (Android 14)
- Details
-
In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- References
Affected packages
Android / platform/packages/apps/Settings
Package
Ecosystem specific
{
"vanir_signatures": [
{
"match_only_versions": [
"15-next"
],
"digest": {
"threshold": 0.9,
"line_hashes": [
"19362163005515750643544123919388329013",
"290741224690397986418975891065267248161",
"219738665414340179411321010363753811153"
]
},
"id": "ASB-A-327749022-22ccafea",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/70a5a0fd353cc6203d2926627de93786155ae5bc",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/com/android/settings/homepage/SettingsHomepageActivity.java"
},
"signature_type": "Line"
},
{
"match_only_versions": [
"15-next"
],
"digest": {
"length": 2115.0,
"function_hash": "238781758302158020989358110392753045614"
},
"id": "ASB-A-327749022-569b2683",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/70a5a0fd353cc6203d2926627de93786155ae5bc",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/com/android/settings/homepage/SettingsHomepageActivity.java",
"function": "onCreate"
},
"signature_type": "Function"
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/70a5a0fd353cc6203d2926627de93786155ae5bc"
],
"spl": "2024-09-01",
"severity": "High",
"types": [
"EoP"
]
}