Improper input validation in Google Android - CVE-2024-0039
Published: March 4, 2024 / Updated: May 31, 2024
Vulnerability identifier: #VU87045
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-0039
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the System component. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code.
Affected software
Google Android
How to mitigate CVE-2024-0039
Install security update from vendor's website.
Google Android - addressed in versions 12L 2024-03-01, 12 2024-03-01, 13 2024-03-01, 14 2024-03-01
Links to Public Exploits and PoC-codes
External References
- https://android.googlesource.com/platform/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8
- https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f0f35273101518d1f3a660b151804e90d0249af3
- https://android.googlesource.com/platform/packages/modules/Bluetooth/+/015c618a0461def93138173a53daaf27ca0630c9
- https://source.android.com/docs/security/bulletin/2024-03-01