CVE-2024-31316

Опубликовано: 09 июл. 2024

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Ссылки

https://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9
Mailing List
Patch
https://source.android.com/security/bulletin/2024-06-01
Patch
Vendor Advisory
https://android.googlesource.com/platform/frameworks/base/+/3457d82f8e265ad615b38f6a2aa3c33f1e100cb9
Mailing List
Patch
https://source.android.com/security/bulletin/2024-06-01
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*

cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*

EPSS

Процентиль: 16%

0.00052

Низкий

7.8 High

CVSS3

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-88wv-r6ff-qxwp