CVE-2024-49735
Published: 21 January 2025
Summary
CVE-2024-49735 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-6 (Resource Availability).
Deeper analysis
CVE-2024-49735 is a vulnerability in Android that involves a failure to persist permissions settings due to resource exhaustion in multiple locations. This issue, classified under CWE-276 (Incorrect Default Permissions), enables local escalation of privilege without requiring additional execution privileges or user interaction. It received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on January 21, 2025.
A local attacker with low-privilege access can exploit this vulnerability due to its low attack complexity and lack of need for user interaction. Successful exploitation allows the attacker to gain elevated privileges, resulting in high confidentiality, integrity, and availability impacts on the affected system.
The Android Security Bulletin dated January 1, 2025, available at https://source.android.com/security/bulletin/2025-01-01, details patches and mitigation guidance for addressing this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43691
Vulnerability details
In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of an incorrect permissions vulnerability (CWE-276) on Android.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in permission persistence due to resource exhaustion by applying patches from the Android Security Bulletin.
Protects critical system resources from exhaustion, preventing the trigger that causes permissions settings to fail to persist and enable privilege escalation.
Enforces approved access control policies to mitigate local privilege escalation resulting from incorrect default permissions due to persistence failure.