CVE-2024-0019: Medium severity Google Android vulnerability
In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14-next:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2024-01-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2024-01-01
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0019?
CVE-2024-0019 has a severity rating that indicates it can lead to local denial of service.
How do I fix CVE-2024-0019?
To fix CVE-2024-0019, ensure your Android device is updated to the latest version that addresses this issue.
What versions of Android are affected by CVE-2024-0019?
CVE-2024-0019 affects Android versions 12.0, 12.1, 13.0, and 14.0.
What causes the issue in CVE-2024-0019?
The issue in CVE-2024-0019 is caused by a missing check for active recordings in the setListening function of AppOpsControllerImpl.java.
Is user interaction required to exploit CVE-2024-0019?
Yes, user interaction is needed to exploit CVE-2024-0019.