CVE-2024-0035: Null Pointer Dereference
In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14-next:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2024-02-01
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0035?
CVE-2024-0035 is considered a local escalation of privilege vulnerability.
How do I fix CVE-2024-0035?
To fix CVE-2024-0035, update your device to the latest version of Android provided by Google.
Which versions of Android are affected by CVE-2024-0035?
CVE-2024-0035 affects Android versions 11.0, 12.0, 12.1, 13.0, and 14.0.
Does exploiting CVE-2024-0035 require user interaction?
No, exploiting CVE-2024-0035 does not require any user interaction.
What aspect of the TileLifecycleManager.java is vulnerable in CVE-2024-0035?
CVE-2024-0035 is vulnerable due to a missing null check in the onNullBinding method.