CVE-2024-40672
Published: 28 January 2025
Summary
CVE-2024-40672 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-40672 is a vulnerability in the onCreate method of ChooserActivity.java within Android's IntentResolver component, located in platform/packages/modules/IntentResolver. The issue stems from a missing permission check, enabling attackers to bypass factory reset protections. This flaw results in local escalation of privilege and is rated at CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-281 (Improper Preservation of Permissions).
A local attacker with no privileges (PR:N) can exploit this vulnerability without user interaction (UI:N) or additional execution privileges. By targeting the affected ChooserActivity, the attacker achieves high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), potentially gaining elevated access on the device and circumventing factory reset safeguards.
The Android Security Bulletin for October 2024 (https://source.android.com/security/bulletin/2024-10-01) documents this vulnerability and recommends updating to patched Android versions. A specific upstream patch is available at https://android.googlesource.com/platform/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727, which addresses the missing permission check.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38749
Vulnerability details
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
more
exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via missing permission check directly matches exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the missing permission check in ChooserActivity.onCreate that enabled privilege escalation.
Requires timely identification, reporting, and correction of flaws like CVE-2024-40672 via patches recommended in the Android Security Bulletin.
Employs least privilege to restrict unprivileged local attackers from achieving high-impact escalation despite the missing permission check.