CVE-2024-0022 — Improper Input Validation in Frameworks Base

CWE-20 — Improper Input ValidationCWE-667 — Improper Locking5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 91.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedMay 7
Latest updateAug 8

Description

In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶Androidplatform/frameworks_base14-next:0 — 14-next:2024-04-01+2
▶CVEListV5google/android13, 14+1
▶NVDgoogle/android13.0, 14.0+1

Patches

Patch: android.googlesource.com ↗Patch: source.android.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gvjh-r2g7-mjgx: In multiple functions of CompanionDeviceManagerService↗2024-05-07
▶
OSV
CVE-2024-0022: In multiple functions of CompanionDeviceManagerService↗2024-04-01
▶

📋Vendor Advisories

2
Red Hat
kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race↗2024-08-08
▶
Android
CVE-2024-0022: Android Security Bulletin 2024-04-01 CVE: CVE-2024-0022 Severity: HIGH Type: ID Affected AOSP versions: 13, 14 References: A-298635078↗2024-04-01
▶