PT-2024-10586 · Google · Android

Published 2024-11-15 · Updated 2024-12-18 · CVE-2017-13314

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to 8.0

Description A security settings bypass is possible due to a missing permission check in the setAllowOnlyVpnForUids function of NetworkManagementService.java. This could lead to local escalation of privilege, allowing users to access non-VPN networks when they are supposed to be restricted to VPN networks, with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android versions prior to 8.0, consider restricting access to the setAllowOnlyVpnForUids function of NetworkManagementService.java to minimize the risk of exploitation. As a temporary workaround, restrict the ability of users to access non-VPN networks when they are supposed to be restricted to VPN networks.

Fix

Incorrect Default Permissions

Missing Authorization

Weakness Enumeration

CWE-276

CWE-862

Related Identifiers

CVE-2017-13314

Affected Products

Android

References · 6

• https://source.android.com/security/bulletin/2018-05-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-13314 · Security Note
• https://osv.dev/vulnerability/CVE-2017-13314 · Vendor Advisory
• https://t.me/cvenotify/102163 · Telegram Post
• https://t.me/cvenotify/104691 · Telegram Post
• https://t.me/cvedetector/11198 · Telegram Post