CVE-2024-40677: High severity android vulnerability

Published Oct 7, 2024

Updated

In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

6 affected components

Google Android

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android=14.0

Google Android=15.0

Event History

Oct 7, 2024

CVE Published

via Android·12:00 AM

Jan 28, 2025

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-40677?

CVE-2024-40677 has a high severity rating due to its potential for local escalation of privilege.

How do I fix CVE-2024-40677?

To fix CVE-2024-40677, users should update their Android devices to the latest security patch provided by Google.

Which Android versions are affected by CVE-2024-40677?

CVE-2024-40677 affects Android versions 12.0, 12.1, 13.0, 14.0, and 15.0.

What type of vulnerability is CVE-2024-40677?

CVE-2024-40677 is a local escalation of privilege vulnerability due to a missing permission check.

Does CVE-2024-40677 require user interaction for exploitation?

No, CVE-2024-40677 does not require user interaction for exploitation.