PT-2025-2642 · Google · Android+1

Published 2025-01-01 · Updated 2025-01-22 · CVE-2024-43095

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue is caused by a logic error in the code, allowing for a possible way to obtain any system permission. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ASB-A-340480881

CVE-2024-43095

Affected Products

Android

Platform/Packages/Modules/Permission

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-43095 · Security Note
• https://source.android.com/security/bulletin/2025-01-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43095 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-340480881 · Vendor Advisory
• https://twitter.com/CVEnew/status/1881933304628138213 · Twitter Post
• https://android.googlesource.com/platform/packages/modules/Permission/+/ea7b26fe98c142d0a87d61c3a1c82335ea29c6d2 · Note
• https://t.me/cvedetector/16056 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1882002848004604063 · Twitter Post