CVE-2024-31320: Android Privilege Escalation Vulnerability

CVE-2024-31320 Overview

CVE-2024-31320 is a privilege escalation vulnerability in the Android Companion Device Manager (CDM) framework. The flaw exists in the setSkipPrompt method of AssociationRequest.java. An attacker with local access can establish a companion device association without any user confirmation prompt. This bypasses a security control designed to require user consent before pairing a companion device with the Android system.

The vulnerability affects Android 12.0 and 12.1. Successful exploitation grants local escalation of privilege with no additional execution privileges needed and requires no user interaction. Google addressed the issue in the July 2024 Android Security Bulletin.

Critical Impact
Local privilege escalation on Android 12.0 and 12.1 through unauthorized companion device association, bypassing user confirmation and enabling access to sensitive device data and capabilities.

Affected Products

Google Android 12.0
Google Android 12.1
Android Open Source Project (AOSP) frameworks/base implementing Companion Device Manager

Discovery Timeline

2024-07-01 - Google publishes fix in Android Security Bulletin July 2024
2024-07-09 - CVE-2024-31320 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31320

Vulnerability Analysis

The vulnerability resides in the Companion Device Manager subsystem of the Android framework. CDM handles the association process between an Android device and companion devices such as watches, fitness trackers, and other Bluetooth or Wi-Fi peripherals. Normally, an application requesting a companion device association triggers a system dialog that requires explicit user approval before the association is created.

The setSkipPrompt method within AssociationRequest.java controls whether this confirmation dialog is displayed. The affected code path allows the confirmation prompt to be skipped without proper caller authorization checks. An attacker leveraging this issue can create arbitrary companion associations, granting an app access to APIs and data ordinarily gated behind explicit user consent.

The issue is categorized under [CWE-269: Improper Privilege Management]. The problem is a missing authorization check, not a memory corruption defect. See the Android Security Bulletin for the complete vendor description.

Root Cause

The root cause is improper enforcement of privilege boundaries around the setSkipPrompt flag inside the CDM association flow. The framework did not adequately verify that callers requesting a skip of the confirmation prompt held the required system-level privilege. Two upstream patches to frameworks/base restore the intended access control on this code path.

Attack Vector

Exploitation requires local access to the target device and the ability to execute code within an installed application context. A malicious application can invoke the CDM association API with the skip-prompt behavior enabled and receive access to companion device APIs without any user interaction. The vulnerability chain enables the attacker to elevate from a low-privilege app context to capabilities normally restricted by user consent, including background access to sensitive companion device data and notifications.

No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-31320

Indicators of Compromise

Unexpected CompanionDeviceManager association entries created without a corresponding user-visible confirmation dialog in system UI logs
Applications holding companion device associations that were not initiated through the standard association activity flow
Anomalous invocations of AssociationRequest with setSkipPrompt set to true from non-privileged app UIDs in logcat output

Detection Strategies

Audit installed applications for unnecessary use of the REQUEST_COMPANION_PROFILE_* permissions and CDM APIs
Monitor Android system logs for CompanionDeviceManagerService events that create associations outside the standard user-confirmed flow
Correlate application install events with subsequent CDM association creation to identify apps performing associations without user interaction

Monitoring Recommendations

Enroll Android 12.0 and 12.1 devices in a mobile device management platform to enforce OS patch level compliance against the July 2024 security patch level or later
Forward mobile telemetry and application inventory data to a centralized log platform for retrospective hunting on CDM-related anomalies
Track application privilege usage over time to identify apps that gain new companion device capabilities without a corresponding user action

How to Mitigate CVE-2024-31320

Immediate Actions Required

Update all Android 12.0 and 12.1 devices to the July 2024 security patch level (2024-07-01) or later
Inventory managed Android devices and prioritize patching for those still on unpatched Android 12 builds
Review installed applications on affected devices and remove any that request companion device permissions without a clear business need

Patch Information

Google addressed CVE-2024-31320 in the Android Security Bulletin July 2024. The fix is delivered through two AOSP commits to frameworks/base: commit 9722ce9d and commit df49e0e3. Device manufacturers ship the fix as part of the 2024-07-01 security patch level. Users should verify the patch level under Settings > About phone > Android security update.

Workarounds

Restrict installation of applications from untrusted sources by disabling sideloading and enforcing installation only from Google Play or a managed enterprise app store
Use mobile device management policies to block or uninstall applications that request companion device permissions without justification
Where patching is not immediately possible, upgrade affected devices to a supported Android release with the fix included

bash

# Check the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-07-01 or later