CVE-2024-34734 Overview
CVE-2024-34734 affects Google Android versions 13 and 14. The vulnerability resides in the onForegroundServiceButtonClicked method of FooterActionsViewModel.kt. An insecure default value allows an attacker with physical access to disable the active VPN application directly from the lockscreen. Exploitation requires no user interaction and no additional execution privileges. The flaw maps to [CWE-1188: Insecure Default Initialization of Resource].
Critical Impact
An attacker with physical device access can disable an active VPN from the lockscreen, exposing subsequent network traffic and enabling local privilege escalation on the device.
Affected Products
- Google Android 13.0
- Google Android 14.0
- System UI component (frameworks/base)
Discovery Timeline
- 2024-08-01 - Google publishes the Android Security Bulletin addressing the issue
- 2024-08-15 - CVE-2024-34734 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-34734
Vulnerability Analysis
The defect lives in the System UI FooterActionsViewModel.kt file, which renders quick-settings footer controls surfaced on the lockscreen. When the foreground-service footer button is tapped, the onForegroundServiceButtonClicked handler evaluates whether to launch a privileged dialog that lets the user stop background foreground services, including a running VPN client.
An insecure default value permits this action path to execute while the device is still locked. Because Android treats an active VPN as a foreground service, the attacker can terminate the VPN tunnel without unlocking the device or presenting biometric or knowledge-factor credentials. Terminating the tunnel drops traffic back to the underlying carrier or Wi-Fi network, breaking the confidentiality and integrity guarantees the VPN was providing.
Root Cause
The root cause is an insecure default in the view model that controls foreground-service actions surfaced in the footer. The default value does not enforce a keyguard authentication check before invoking the stop-service flow. This is a classic [CWE-1188] insecure default initialization pattern in a security-sensitive UI component.
Attack Vector
Exploitation requires local physical access to a locked device. The attacker opens the quick-settings panel from the lockscreen, taps the foreground-services indicator, and stops the running VPN service. No credentials, PIN, biometric, or unlock event is required. The applied patch is available in the Android source tree at commit 207584fb6f, which corrects the default and enforces authentication before the action proceeds.
Detection Methods for CVE-2024-34734
Indicators of Compromise
- Unexpected VPN disconnection events logged by the mobile VPN client while the device was reported as locked.
- Gaps in corporate VPN session telemetry followed by direct traffic from the same device to the internet.
- ForegroundServiceController or System UI logs showing service-stop actions issued while KeyguardManager.isDeviceLocked() was true.
Detection Strategies
- Correlate mobile device management (MDM) posture events with VPN session termination to flag disconnects that occur without an unlock event.
- Monitor for Android build fingerprints on versions 13 and 14 that lack the August 2024 security patch level via MDM compliance reporting.
- Alert when managed devices lose VPN coverage but continue producing network traffic to enterprise resources.
Monitoring Recommendations
- Enforce and monitor an MDM policy requiring the August 2024 Android security patch level or later.
- Ingest mobile VPN client logs into a centralized analytics platform and baseline expected disconnect patterns per user.
- Track sudden shifts from VPN egress IPs to direct carrier or Wi-Fi egress for managed identities.
How to Mitigate CVE-2024-34734
Immediate Actions Required
- Deploy the August 2024 Android security patch (2024-08-01 patch level) to all Android 13 and 14 devices in the fleet.
- Enforce MDM compliance rules that block corporate access from devices below the required patch level.
- Educate users that leaving devices unattended, even locked, can allow an attacker to disable protections.
Patch Information
Google addressed the issue in the Android Security Bulletin August 2024. The upstream fix is committed in AOSP frameworks/base at 207584fb6f820eba14251251d7e9331bfd57adb8. Device manufacturers ship the fix as part of the 2024-08-01 security patch level; verify the patch level under Settings > About phone > Android security update.
Workarounds
- Disable the quick-settings panel on the lockscreen through MDM configuration until patched builds are deployed.
- Require an always-on VPN with the Block connections without VPN option so any tunnel termination halts network traffic rather than falling back to clear-text.
- Restrict physical access to unattended devices and enable short screen-lock timeouts to reduce the exploitation window.
# Verify Android security patch level on a managed device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-08-01 or later
# Enforce always-on VPN with lockdown for the corporate VPN package
adb shell settings put global always_on_vpn_app com.example.corp.vpn
adb shell settings put global always_on_vpn_lockdown 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
