CVE-2024-40659

In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://android.googlesource.com/platform/packages/modules/RemoteKeyProvisioning/+/c65dce4c6d8d54e47dce79a56e29e2223a2354e6
https://source.android.com/security/bulletin/2024-09-01

Configurations

No configuration.

History

04 Nov 2024, 18:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CWE		CWE-120

11 Sep 2024, 16:26

Type	Values Removed	Values Added
Summary		(es) En getRegistration de RemoteProvisioningService.java, existe una forma posible de deshabilitar permanentemente la función de generación de claves de AndroidKeyStore mediante la actualización de las claves de certificación de todas las aplicaciones instaladas debido a una validación de entrada incorrecta. Esto podría provocar una denegación de servicio local sin necesidad de privilegios de ejecución adicionales. No se necesita la interacción del usuario para la explotación.

11 Sep 2024, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-11 00:15

Updated : 2024-11-04 18:35

NVD link : CVE-2024-40659

Mitre link : CVE-2024-40659

CVE.ORG link : CVE-2024-40659

JSON object : View

Products Affected

No product.

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

5.5 /10