CVE-2024-40672
Published: 28 January 2025
Summary
CVE-2024-40672 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly addressing the missing permission check in ChooserActivity.onCreate that enabled privilege escalation.
Requires timely identification, reporting, and correction of flaws like CVE-2024-40672 via patches recommended in the Android Security Bulletin.
Employs least privilege to restrict unprivileged local attackers from achieving high-impact escalation despite the missing permission check.
NVD Description
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
more
exploitation.
Deeper analysisAI
CVE-2024-40672 is a vulnerability in the onCreate method of ChooserActivity.java within Android's IntentResolver component, located in platform/packages/modules/IntentResolver. The issue stems from a missing permission check, enabling attackers to bypass factory reset protections. This flaw results in local escalation of privilege and is rated at CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-281 (Improper Preservation of Permissions).
A local attacker with no privileges (PR:N) can exploit this vulnerability without user interaction (UI:N) or additional execution privileges. By targeting the affected ChooserActivity, the attacker achieves high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), potentially gaining elevated access on the device and circumventing factory reset safeguards.
The Android Security Bulletin for October 2024 (https://source.android.com/security/bulletin/2024-10-01) documents this vulnerability and recommends updating to patched Android versions. A specific upstream patch is available at https://android.googlesource.com/platform/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727, which addresses the missing permission check.
Details
- CWE(s)