CVE-2024-49736
📋 TL;DR
This vulnerability allows triggering a factory reset on Android devices without user consent due to a logic error in the MainClear.java onClick handler. It affects Android devices running vulnerable versions, potentially causing data loss and device disruption. Exploitation requires local access but no special privileges.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device data loss including personal files, apps, and settings; device becomes unusable until reconfiguration
Likely Case
Local denial of service causing device reset, data loss, and productivity disruption
If Mitigated
Minimal impact if devices are regularly backed up and can be quickly reconfigured
🎯 Exploit Status
Exploitation requires local access to device but no user interaction; could be triggered by malicious apps or physical access
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Update 2025-01-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/2025-01-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install available security updates. 3. Restart device after installation.
🔧 Temporary Workarounds
Disable factory reset permissions
androidRestrict which apps can trigger factory reset operations
adb shell pm revoke <package-name> android.permission.FACTORY_RESET
🧯 If You Can't Patch
- Implement device management policies to restrict physical access to vulnerable devices
- Enable regular automated backups to minimize data loss impact
🔍 How to Verify
Check if Vulnerable:
Check Android version and security patch level in Settings > About phone > Android versionCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level is 2025-01-01 or later in Settings > About phone > Android version📡 Detection & Monitoring
Log Indicators:
- Factory reset events in system logs
- Unexpected MainClear.java activity
Network Indicators:
- Device re-enrollment traffic after reset
SIEM Query:
source="android_system" event_type="factory_reset"