Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2024-34738: Android AppOpsService lets apps see their own restriction settings
CVE-2024-34738 · published 2 years ago
Summary
On Android devices, a coding mistake in the system component that tracks app permissions allows any app to read its own restricted operation status. This information can be used by the app to increase its own privileges without needing extra permissions or user interaction. Apply the latest Android security updates from Google to fix the issue.
What to do
- Update google platform/frameworks/base to version 14-next:2024-08-01.
- Update google platform/frameworks/base to version 13:2024-08-01.
- Update google platform/frameworks/base to version 14:2024-08-01.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | android |
13.0 14.0 cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* |
|
| Android | platform/frameworks/base |
>= 14-next:0, < 14-next:2024-08-01 >= 13:0, < 13:2024-08-01 >= 14:0, < 14:2024-08-01 Fix: upgrade to 14-next:2024-08-01
|
Original advisory text
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in the code. This could lead to local es...
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published1 Aug 2024
Updated30 Sep 2026
First seen7 Mar 2026
Track software like this
Free during beta