Lucene search

Google_androidCVE-2024-40655

HistorySep 11, 2024 - 12:15 a.m.

CVE-2024-40655

2024-09-1100:15:11

google_android

web.nvd.nist.gov

permissions bypass

callscreeningservicehelper

local escalation

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

9.6%

JSON

In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected configurations

Vulners

Vulnrichment

Node

googleandroidMatch14

googleandroidMatch13

googleandroidMatch14

googleandroidMatch13

googleandroidMatch12l

googleandroidMatch14

googleandroidMatch13

googleandroidMatch12l

googleandroidMatch12

VendorProductVersionCPE
googleandroid14cpe:2.3:o:google:android:14:*:*:*:*:*:*:*
googleandroid13cpe:2.3:o:google:android:13:*:*:*:*:*:*:*
googleandroid12lcpe:2.3:o:google:android:12l:*:*:*:*:*:*:*
googleandroid12cpe:2.3:o:google:android:12:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	14	cpe:2.3:o:google:android:14:::::::*
google	android	13	cpe:2.3:o:google:android:13:::::::*
google	android	12l	cpe:2.3:o:google:android:12l:::::::*
google	android	12	cpe:2.3:o:google:android:12:::::::*

CNA Affected

[
  {
    "vendor": "Google",
    "product": "Android",
    "versions": [
      {
        "version": "14",
        "status": "affected"
      },
      {
        "version": "13",
        "status": "affected"
      },
      {
        "version": "12L",
        "status": "affected"
      },
      {
        "version": "12",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

android.googlesource.com/platform/packages/services/Telecomm/+/eeef54b37a362f506ea3aa155baddc545b6a909a

source.android.com/security/bulletin/2024-09-01

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-40655