CVE-2024-0015: High severity Google Android vulnerability
In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14-next:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2024-01-01
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0015?
CVE-2024-0015 has a high severity rating due to its potential to allow local escalation of privilege.
How do I fix CVE-2024-0015?
To fix CVE-2024-0015, ensure that you update your Android device to the latest version provided by Google.
Which versions of Android are affected by CVE-2024-0015?
CVE-2024-0015 affects Android versions 11.0, 12.0, 12.1, and 13.0.
Can CVE-2024-0015 be exploited without user interaction?
Yes, exploitation of CVE-2024-0015 does not require user interaction.
What is the risk associated with CVE-2024-0015?
The risk associated with CVE-2024-0015 is the potential for an attacker to launch arbitrary protected activities, leading to unauthorized access.