CVE-2024-40676
HIGHAndroid - Local Privilege Escalation via Confused Deputy in AccountManagerService
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-40676. PoCs published by CrackerCat.
AI-analyzed exploit summary The repository contains Android framework source code files related to account management, specifically focusing on the AccountAuthenticatorCache and AccountManagerBackupHelper classes. It appears to be a technical analysis or patch diff for CVE-2024-40676, likely involving authentication or permission handling vulnerabilities in Android's account management system.
Description
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Exploits (1)
The repository contains Android framework source code files related to account management, specifically focusing on the AccountAuthenticatorCache and AccountManagerBackupHelper classes. It appears to be a technical analysis or patch diff for CVE-2024-40676, likely involving authentication or permission handling vulnerabilities in Android's account management system.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N