CVE-2024-0014: High severity android vulnerability

Published Feb 5, 2024

Updated

In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

6 affected components

Google Android

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android=14.0

Event History

Feb 5, 2024

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Feb 16, 2024

CVE Published

via MITRE·12:08 AM

Data Sourced

via MITRE·12:08 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2024-0014?

CVE-2024-0014 is classified as a high severity vulnerability due to its potential for local escalation of privilege.

How do I fix CVE-2024-0014?

To fix CVE-2024-0014, users should update their Android devices to the latest security patch released by Google.

Who is affected by CVE-2024-0014?

CVE-2024-0014 affects users of Google Android versions 11.0 through 14.0.

Is user interaction required to exploit CVE-2024-0014?

No, user interaction is not needed for the exploitation of CVE-2024-0014.

What kind of impact does CVE-2024-0014 have on devices?

CVE-2024-0014 can lead to local escalation of privilege, compromising device security without additional execution privileges.