CVE-2024-0040: Buffer Overflow
In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 14-next:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 11:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 12:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 12L:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 13:2024-02-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 14:2024-02-01
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0040?
CVE-2024-0040 is considered a medium severity vulnerability due to its potential for remote information disclosure.
How do I fix CVE-2024-0040?
To fix CVE-2024-0040, ensure that your Android version is updated to the latest security patch that addresses this vulnerability.
Which Android versions are affected by CVE-2024-0040?
CVE-2024-0040 affects Google Android versions 11.0, 12.0, 12.1, 13.0, and 14.0.
Can CVE-2024-0040 be exploited without user interaction?
Yes, CVE-2024-0040 can be exploited without any user interaction required.
What type of vulnerability is CVE-2024-0040?
CVE-2024-0040 is categorized as a heap buffer overflow, leading to possible out of bounds read.