PT-2024-5206 · Google · Android

Published 2024-07-01 · Updated 2024-12-17 · CVE-2024-31320

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android versions 12 through 12L

Description: The issue is related to errors in privilege management, specifically in the setSkipPrompt function of AssociationRequest.java. This could allow an attacker to establish a companion device association without confirmation, leading to local escalation of privilege with no additional execution privileges needed. User interaction is not necessary for exploitation.

Recommendations: For Android versions 12 through 12L, update your device to the latest security patch level, specifically 2024-07-05, which contains fixes for all 25 vulnerabilities, including this issue. As a temporary workaround, consider restricting access to the vulnerable component until a patch is available.

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

ASB-A-329230490

BDU:2024-05763

CVE-2024-31320

Affected Products

Android

References · 15

• https://android.googlesource.com/platform/frameworks/base/+/df49e0e3083b0707e2cca5a5956b49f14ded078e · Patch
• https://osv.dev/vulnerability/CVE-2024-31320 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/9722ce9d733edab76163fbcd21b231424e3d7061 · Patch
• https://source.android.com/security/bulletin/2024-07-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31320 · Security Note
• https://osv.dev/vulnerability/ASB-A-329230490 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05763 · Security Note
• https://t.me/zerodayalert/264 · Telegram Post
• https://twitter.com/PathakCharu/status/1825767549180555350 · Twitter Post
• https://twitter.com/Gizchina/status/1808987070938898463 · Twitter Post
• https://twitter.com/x_newstech/status/1808553562248564803 · Twitter Post
• https://t.me/cvenotify/104597 · Telegram Post
• https://twitter.com/Cybermaterial_/status/1808546485811790035 · Twitter Post
• https://t.me/true_secator/5937 · Telegram Post
• https://twitter.com/CVEnew/status/1810944966035952013 · Twitter Post