CVE-2024-0015

Summary

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Affected Software

Weaknesses

• Elevation of privilege

ADP Enrichment

CVE Program Container

Additional References

• https://android.googlesource.com/platform/frameworks/base/+/2ce1b7fd37273ea19fbbb6daeeaa6212357b9a70
• https://source.android.com/security/bulletin/2024-01-01

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://android.googlesource.com/platform/frameworks/base/+/2ce1b7fd37273ea19fbbb6daeeaa6212357b9a70
• https://source.android.com/security/bulletin/2024-01-01

• ←Previous
• Next→