CVE-2024-0038

Опубликовано: 16 фев. 2024

Источник: nvd

CVSS3: 7.8

CVSS3: 8.4

EPSS Низкий

Описание

In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Ссылки

https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079
Mailing List
Patch
https://source.android.com/security/bulletin/2024-02-01
Patch
Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079
Mailing List
Patch
https://source.android.com/security/bulletin/2024-02-01
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*

EPSS

Процентиль: 7%

0.00026

Низкий

7.8 High

CVSS3

8.4 High

CVSS3

Дефекты

CWE-862

Связанные уязвимости

GHSA-mp67-wx57-8m4f

CVSS3: 8.4

github

почти 2 года назад

EPSS

Процентиль: 7%

0.00026

Низкий

7.8 High

CVSS3

8.4 High

CVSS3

Дефекты

CWE-862