CVE-2024-31324
📋 TL;DR
This Android vulnerability allows attackers to bypass tapjacking/overlay protection by manipulating screen orientation during activity launches. It enables local privilege escalation when users interact with malicious apps. Affects Android devices running vulnerable versions.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing malicious apps to gain elevated privileges, access sensitive data, or install persistent malware.
Likely Case
Malicious apps trick users into granting permissions or performing actions they didn't intend, leading to data theft or unauthorized access.
If Mitigated
Limited impact with proper app vetting and user awareness, though some overlay attacks may still succeed.
🎯 Exploit Status
Requires user interaction and specific screen orientation manipulation; not trivial but achievable by determined attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: June 2024 Android Security Patch
Vendor Advisory: https://source.android.com/security/bulletin/2024-06-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install June 2024 Android security patch. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable automatic screen rotation
androidPrevents the orientation change required for exploitation
Install apps only from trusted sources
androidReduces risk of encountering malicious apps exploiting this vulnerability
🧯 If You Can't Patch
- Enable Google Play Protect and keep it updated
- Review app permissions carefully and deny unnecessary overlay permissions
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before June 2024, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows 'June 1, 2024' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unusual activity launches with rapid orientation changes
- Permission escalation attempts from untrusted apps
SIEM Query:
Not applicable for typical mobile device management🔗 References
- https://android.googlesource.com/platform/frameworks/base/+/f16cc1135b414906164eb8fc55a76971b0e36c21
- https://source.android.com/security/bulletin/2024-06-01
- https://android.googlesource.com/platform/frameworks/base/+/f16cc1135b414906164eb8fc55a76971b0e36c21
- https://source.android.com/security/bulletin/2024-06-01
