CVE-2024-31313
📋 TL;DR
This vulnerability in Android's Fast Message Queue (FMQ) library allows an out-of-bounds write due to incorrect bounds checking in the availableToWriteBytes function. It enables local privilege escalation without requiring user interaction or additional execution privileges. Affected systems include Android devices running vulnerable versions of the libfmq library.
💻 Affected Systems
- Android devices using Fast Message Queue (FMQ) library
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through local privilege escalation to root/system-level access, potentially leading to complete device control, data theft, or installation of persistent malware.
Likely Case
Local attacker gains elevated privileges to access sensitive data, modify system settings, or install malicious applications without user consent.
If Mitigated
Limited impact with proper security controls like SELinux, app sandboxing, and timely patching preventing successful exploitation.
🎯 Exploit Status
Exploitation requires local access but no user interaction. The vulnerability is in a system library used for inter-process communication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android June 2024 security patch or later
Vendor Advisory: https://source.android.com/security/bulletin/2024-06-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install the June 2024 or later security patch. 3. Reboot the device after installation.
🔧 Temporary Workarounds
Restrict local app installations
androidPrevent installation of untrusted applications that could exploit this vulnerability
adb shell settings put secure install_non_market_apps 0
🧯 If You Can't Patch
- Implement strict application allowlisting to prevent untrusted apps from running
- Enable enhanced security features like SELinux and app sandboxing to limit impact
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version > Security patch level. If before June 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows June 2024 or later. Check that the libfmq library has been updated to version containing commit 79bbf4aeef4b254c52da670a972e22956c8c659d.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in system logs
- SELinux denials related to libfmq or FMQ operations
- Abnormal process behavior indicating out-of-bounds memory access
Network Indicators:
- No direct network indicators as this is a local vulnerability
SIEM Query:
source="android_system_logs" AND (event="privilege_escalation" OR event="selinux_denial") AND process="*fmq*"🔗 References
- https://android.googlesource.com/platform/system/libfmq/+/79bbf4aeef4b254c52da670a972e22956c8c659d
- https://source.android.com/security/bulletin/2024-06-01
- https://android.googlesource.com/platform/system/libfmq/+/79bbf4aeef4b254c52da670a972e22956c8c659d
- https://source.android.com/security/bulletin/2024-06-01
