CVE-2024-49724

In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*

History

22 Apr 2025, 14:38

Type Values Removed Values Added
References () https://source.android.com/security/bulletin/2025-01-01 - () https://source.android.com/security/bulletin/2025-01-01 - Vendor Advisory
First Time Google
Google android
CPE cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

24 Mar 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.0
CWE CWE-276

18 Feb 2025, 20:15

Type Values Removed Values Added
CWE CWE-362
CVSS v2 : unknown
v3 : 7.0
v2 : unknown
v3 : unknown
Summary
  • (es) En varias funciones de AccountManagerService.java, existe una forma posible de eludir permisos e iniciar actividades protegidas debido a una condición ejecución. Esto podría provocar una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. Se necesita la interacción del usuario para la explotación.

22 Jan 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.0
CWE CWE-362

21 Jan 2025, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-01-21 23:15

Updated : 2025-04-22 14:38


NVD link : CVE-2024-49724

Mitre link : CVE-2024-49724

CVE.ORG link : CVE-2024-49724


JSON object : View

Products Affected

google

  • android
CWE
CWE-276

Incorrect Default Permissions