CVE-2024-40676
Published: 28 January 2025
Summary
CVE-2024-40676 is a high-severity Type Confusion (CWE-843) vulnerability in Google Android. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-40676 is a vulnerability in the checkKeyIntent function of AccountManagerService.java within the Android Open Source Project's platform/frameworks/base component. It stems from a confused deputy issue (CWE-843) that allows bypassing intent security checks, enabling the installation of an unknown app. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and was published on 2025-01-28.
A local attacker requires no privileges, user interaction, or additional execution capabilities to exploit this issue. Exploitation results in local escalation of privilege, providing high impacts on confidentiality and integrity by allowing unauthorized app installation and privilege elevation on the affected device.
The Android Security Bulletin for October 2024 details the patch and mitigation steps at https://source.android.com/security/bulletin/2024-10-01. The specific fix is implemented in commit e8a53246607b52b15269f97aef9ba7e928ba2473, available at https://android.googlesource.com/platform/frameworks/base/+/e8a53246607b52b15269f97aef9ba7e928ba2473; practitioners should prioritize updating affected Android devices to versions incorporating this patch.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38798
Vulnerability details
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
more
is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables local privilege escalation via confused deputy bypass for unauthorized app installation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations in system services like AccountManagerService to prevent bypassing intent security checks via confused deputy exploitation.
Requires validation of intent inputs in checkKeyIntent to ensure only authorized callers can trigger app installation actions.
Limits privileges of processes acting on behalf of users in AccountManagerService, reducing the impact of local escalation from unauthorized app installs.