Local Privilege Escalation in Android Framework by Google
CVE-2024-31320
Key Information:
Badges
Summary
A vulnerability exists in the Android Framework, specifically in the 'setSkipPrompt' method of the 'AssociationRequest.java' file. This flaw allows the establishment of a companion device association without the necessary user confirmation due to a misconfiguration in the Companion Device Manager (CDM). The exploitation of this vulnerability does not require any additional execution privileges, nor does it necessitate user interaction, making it particularly concerning for device security. Unauthorized associations could lead to potential misuse of device functionalities.
Affected Version(s)
Android 12L
Android 12
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published