CVE-2024-34722: High severity Google Android vulnerability

Published Jul 1, 2024

Updated

In smpprocrand of smpact.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected components

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android=14.0

Google Android

Remediation

Patch Available

https://android.googlesource.com/platform/packages/modules/Bluetooth/+/456f705b9acc78d8184536baff3d21b0bc11c957

Event History

Jul 9, 2024

CVE Published

via MITRE·08:11 PM

Data Sourced

via MITRE·08:11 PM

DescriptionWeakness

Jan 6, 2025

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-34722?

CVE-2024-34722 has a high severity rating due to the potential for remote escalation of privilege without user interaction.

How do I fix CVE-2024-34722?

To fix CVE-2024-34722, update your Android device to the latest security patch provided by Google.

Who is affected by CVE-2024-34722?

CVE-2024-34722 affects users of Google Android versions 12.0, 12.1, 13.0, and 14.0.

What kind of vulnerability is CVE-2024-34722?

CVE-2024-34722 is an authentication bypass vulnerability that occurs during legacy Bluetooth Low Energy pairing.

Is user interaction required to exploit CVE-2024-34722?

No, user interaction is not needed for exploitation of CVE-2024-34722, making it particularly concerning.