cyfenced.com →

[ CVE-2024-43093 · Published 13 Nov 2024 ]

Android Framework Privilege Escalation Vulnerability

Exploited · CISA KEV CVSS 7.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-11-07

[ Description ]Official description

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CISA: Android Framework contains an unspecified vulnerability that allows for privilege escalation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 28 Nov 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References