Potential Escalation of Privileges Vulnerability in Google Settings App
CVE-2024-40652

7.8HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
11 September 2024

What is CVE-2024-40652?

A vulnerability exists within the Android Settings application that allows unauthorized access during the device provisioning process. Specifically, in the onCreate method of the SettingsHomepageActivity.java, there is an oversight due to a missing permission check. This deficiency can enable local privilege escalation, potentially allowing attackers to access sensitive settings without requiring additional execution privileges. Although user interaction is necessary for exploitation, the implications of this vulnerability underline the importance of thorough permission validation in system applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Android 14

Android 13

Android 12L

References

https://android.googlesource.com/platform/packages/apps/S...
https://source.android.com/security/bulletin/2024-09-01

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.