CVE-2024-43764
Published: 03 January 2025
Summary
CVE-2024-43764 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-11 (Device Lock).
Deeper analysis
CVE-2024-43764 is a vulnerability in the onPrimaryClipChanged method of ClipboardListener.java within the Android Open Source Project's frameworks/base component. It enables a partial bypass of the lock screen, potentially leading to local escalation of privilege. No additional execution privileges or user interaction are required for exploitation. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this issue with low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing the attacker to elevate privileges on the device.
The Android security bulletin for December 2024 details the issue and provides mitigation through an upstream patch, available at the commit https://android.googlesource.com/platform/frameworks/base/+/70eb75df7d342429c3ee225feb7c011df727442f. Security practitioners should apply the relevant Android updates to address this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40410
Vulnerability details
In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via lock screen bypass on Android device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely identification, reporting, and patching of the flaw in ClipboardListener.java directly prevents the lock screen bypass and local privilege escalation.
Enforcing device lock after inactivity or on demand mitigates clipboard-based bypass attempts by requiring reauthentication for access.
Access enforcement mechanisms ensure clipboard listeners mediate logical access appropriately, preventing unauthorized privilege escalation during lock screen states.