CVE-2024-23705 Overview
CVE-2024-23705 affects Google Android versions 12.0, 12.1, 13.0, and 14.0. The vulnerability stems from improper input validation in multiple locations within the Android platform framework. This flaw causes a failure to persist or enforce user restrictions, opening a path to local privilege escalation. Exploitation requires user interaction but no additional execution privileges. Google addressed the issue in the Android Security Bulletin dated May 1, 2024, with a corresponding patch to the platform/frameworks/base repository.
Critical Impact
A local attacker who convinces a user to perform a specific interaction can bypass enforced user restrictions and elevate privileges on affected Android devices, compromising confidentiality, integrity, and availability.
Affected Products
- Google Android 12.0
- Google Android 12.1 and 13.0
- Google Android 14.0
Discovery Timeline
- 2024-05-07 - CVE-2024-23705 published to the National Vulnerability Database
- 2024-05-01 - Google publishes the Android Security Bulletin addressing the flaw
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-23705
Vulnerability Analysis
CVE-2024-23705 is an input validation weakness [CWE-20] within the Android platform framework. The affected code paths fail to correctly validate inputs used when persisting or enforcing user restrictions. As a result, restrictions applied through Android's multi-user or device policy mechanisms may not be reliably retained or enforced across relevant operations.
Because user restrictions govern behaviors such as app installation, network configuration, and account management, a failure to enforce them provides an attacker with an avenue to reach privileged functionality reserved for administrators or the primary user. The Android Security Bulletin classifies the flaw as enabling local escalation of privilege without additional execution privileges.
Root Cause
The root cause is improper input validation in multiple locations within platform/frameworks/base. According to Google's fix at commit 032bee6dc118ce1cc3fde92463b2954c1450f2e8, the affected logic did not adequately sanitize or verify parameters used in restriction handling. When malformed or unexpected input reached these code paths, the system either failed to persist the intended restriction state or failed to enforce it at runtime.
Attack Vector
Exploitation is local and requires user interaction. An attacker typically delivers a malicious application through sideloading or a compromised distribution channel. Once installed, the application prompts the user to perform an action such as approving a dialog, granting a permission, or interacting with a crafted UI element. The interaction triggers the vulnerable code path, allowing the app to bypass user restrictions and gain elevated capabilities on the device. No network access is required, and the attack complexity is low.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Android Source Code Update for the patch details.
Detection Methods for CVE-2024-23705
Indicators of Compromise
- Installation of applications from untrusted sources followed by unexpected changes to user or device restriction settings.
- Applications requesting or triggering unusual restriction-related dialogs immediately after installation.
- Discrepancies between configured device policy restrictions and the effective policy state reported by the framework.
Detection Strategies
- Monitor Android device logs for anomalies in UserManager and DevicePolicyManager operations related to setting or querying restrictions.
- Use enterprise mobility management (EMM) telemetry to identify devices where enforced restrictions no longer match expected policy baselines.
- Flag Android devices running versions 12.0, 12.1, 13.0, or 14.0 that have not received the May 2024 security patch level.
Monitoring Recommendations
- Track the Android security patch level across the fleet and alert when devices fall behind the 2024-05-01 patch level.
- Correlate application install events with subsequent user-interaction prompts that reference restriction changes.
- Review managed device compliance reports for silent drift in restriction enforcement.
How to Mitigate CVE-2024-23705
Immediate Actions Required
- Update affected Android devices to a security patch level of 2024-05-01 or later as delivered by the device manufacturer.
- Restrict sideloading by disabling installation from unknown sources on managed devices.
- Audit installed applications on unpatched devices and remove any that are untrusted or unnecessary.
- Enforce EMM policies that require the latest available Android security patch level before granting access to corporate resources.
Patch Information
Google released the fix in the Android Security Bulletin May 2024. The corresponding code change is available in the Android Source Code Update at commit 032bee6dc118ce1cc3fde92463b2954c1450f2e8. Device manufacturers integrate this patch into their vendor-specific OTA updates, so the exact rollout date varies by OEM and carrier.
Workarounds
- Where patching is delayed, block installation of applications outside of Google Play through EMM configuration.
- Educate users to reject unexpected permission or restriction prompts from newly installed applications.
- Isolate unpatched devices from sensitive corporate data by tightening conditional access policies until the vendor OTA becomes available.
# Example: verify the Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2024-05-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
