CVE-2024-49732
Published: 21 January 2025
Summary
CVE-2024-49732 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-49732 is a vulnerability affecting multiple functions in CompanionDeviceManagerService.java within the Android operating system. It stems from a missing permission check that enables the granting of permissions without user consent, potentially leading to local escalation of privilege. No additional execution privileges are required beyond basic local access, and the issue is rated at a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), linked to CWE-276 (Incorrect Default Permissions). The vulnerability was published on 2025-01-21.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation allows elevation to higher privileges, resulting in high impacts on confidentiality, integrity, and availability, such as unauthorized access to sensitive data or system resources.
The official Android security bulletin provides mitigation details, available at https://source.android.com/security/bulletin/2025-01-01, which includes patches for affected Android versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43698
Vulnerability details
In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing permission check directly enables local privilege escalation (T1068) without additional execution privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved authorizations for access to system resources, directly addressing the missing permission check in CompanionDeviceManagerService that enabled local privilege escalation.
AC-25 requires a reference monitor to enforce access control policies with validation mechanisms, mitigating the absence of permission checks in affected service functions.
AC-6 enforces least privilege for processes, limiting the impact of unauthorized permission grants resulting from the missing checks.