CVE-2024-49732
📋 TL;DR
This vulnerability in Android's CompanionDeviceManagerService allows local attackers to grant permissions without user consent due to missing permission checks. It enables local privilege escalation without requiring additional execution privileges or user interaction. All Android devices running vulnerable versions are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical or remote access to the device could gain elevated privileges, potentially compromising the entire device, accessing sensitive data, or installing persistent malware.
Likely Case
Malicious apps could exploit this to gain permissions they shouldn't have, accessing sensitive device functions or user data without detection.
If Mitigated
With proper security controls and timely patching, the risk is limited to isolated privilege escalation attempts that can be detected and contained.
🎯 Exploit Status
Exploitation requires local access to the device but no user interaction. The complexity is medium due to the need to understand Android's permission system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android security update from January 2025 or later
Vendor Advisory: https://source.android.com/security/bulletin/2025-01-01
Restart Required: No
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install the January 2025 security update or later. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable unnecessary companion device permissions
allReview and restrict companion device permissions for apps that don't need them
🧯 If You Can't Patch
- Implement strict app installation policies to prevent malicious apps from being installed
- Use mobile device management (MDM) solutions to monitor for suspicious permission requests
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If it's before the January 2025 security update, the device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify the Android security patch level shows January 2025 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unusual permission grants in system logs
- CompanionDeviceManagerService permission bypass attempts
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
Look for events related to permission escalation or CompanionDeviceManagerService anomalies in Android device logs