CVE-2024-31314

MEDIUM

Android - Denial of Service via ShortcutService Resource Exhaustion

Title source: llm

Description

In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References (2)

Core 2

Core References

Mailing List, Patch

https://android.googlesource.com/platform/frameworks/base/+/c0d5f75e01308fb7d6d86639a0a6e2ff81b30be6

Patch, Vendor Advisory

https://source.android.com/security/bulletin/2024-06-01

Scores

CVSS v3 5.5

EPSS 0.0007

EPSS Percentile 20.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-770

Status published

Products (4)

google/android 12.0

google/android 12.1

google/android 13.0

google/android 14.0

Published Jul 09, 2024

Tracked Since Feb 18, 2026