CVE-2024-31322
📋 TL;DR
This vulnerability allows a malicious Android app to hide from device Settings while retaining Accessibility Service permissions, enabling local privilege escalation without requiring additional execution privileges. Exploitation requires user interaction to install/run the app, affecting Android devices with vulnerable versions.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains persistent elevated privileges, potentially enabling surveillance, data theft, or further system compromise through hidden accessibility services.
Likely Case
Malicious apps abuse accessibility permissions to perform unauthorized actions like keylogging, screen capture, or UI automation while remaining hidden from user awareness.
If Mitigated
With proper app vetting and user caution, the risk is limited to isolated privilege abuse without broader system compromise.
🎯 Exploit Status
Requires user interaction to install/run malicious app and grant accessibility permissions; no public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level June 2024 or later
Vendor Advisory: https://source.android.com/security/bulletin/2024-06-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Apply the June 2024 Android security patch. 3. Restart device after installation.
🔧 Temporary Workarounds
Disable unnecessary accessibility services
androidReview and disable accessibility services for untrusted apps to reduce attack surface.
Settings > Accessibility > Installed services > Toggle off for suspicious apps
Restrict app installations
androidPrevent installation from unknown sources to block potential malicious apps.
Settings > Security > Install unknown apps > Disable for all apps
🧯 If You Can't Patch
- Monitor and audit accessibility service permissions regularly for suspicious apps.
- Implement mobile device management (MDM) policies to restrict app installations and monitor for anomalies.
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version > Security patch level. If before June 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Confirm Security patch level shows 'June 1, 2024' or later after applying update.📡 Detection & Monitoring
Log Indicators:
- Unexpected accessibility service activations in system logs
- Apps requesting accessibility permissions without clear user benefit
Network Indicators:
- None - local privilege escalation only
SIEM Query:
Search for accessibility service permission grants to recently installed or untrusted applications.🔗 References
- https://android.googlesource.com/platform/frameworks/base/+/c1bc907a649addd5b97d489fd39afb956164a46c
- https://source.android.com/security/bulletin/2024-06-01
- https://android.googlesource.com/platform/frameworks/base/+/c1bc907a649addd5b97d489fd39afb956164a46c
- https://source.android.com/security/bulletin/2024-06-01
