CVE-2024-40677: Google Android Privilege Escalation Flaw

CVE-2024-40677 Overview

CVE-2024-40677 is a local privilege escalation vulnerability in the Android Settings application. The flaw resides in the shouldSkipForInitialSUW method of AdvancedPowerUsageDetail.java. A missing permission check allows an attacker with local access to bypass Factory Reset Protection (FRP) during the initial Setup Wizard flow. Google addressed the issue in the Android Security Bulletin October 2024. The vulnerability affects Android versions 12.0, 12.1, 13.0, 14.0, and 15.0. Exploitation requires no user interaction and no additional execution privileges beyond local device access.

Critical Impact
An attacker with physical access to a locked or reset Android device can bypass Factory Reset Protection, undermining anti-theft controls and enabling local privilege escalation.

Affected Products

Google Android 12.0 and 12.1
Google Android 13.0 and 14.0
Google Android 15.0

Discovery Timeline

2024-10-01 - Google publishes fix in the Android Security Bulletin
2025-01-28 - CVE-2024-40677 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40677

Vulnerability Analysis

The vulnerability is classified as Missing Authorization [CWE-862]. It affects the AdvancedPowerUsageDetail component within the Android Settings package. The shouldSkipForInitialSUW function determines whether certain settings screens should be skipped during the Setup Wizard (SUW) phase that runs immediately after a factory reset.

Factory Reset Protection is designed to prevent unauthorized use of a device after a reset by requiring the original Google account credentials. The missing permission check in this code path allows an attacker to reach privileged settings screens without proving prior device ownership. This effectively bypasses the FRP gate that normally blocks access until authentication succeeds.

Root Cause

The root cause is a missing permission or caller-identity check in shouldSkipForInitialSUW. The method does not verify that the invoking context is authorized to interact with the power usage detail screen during the initial Setup Wizard. Google's fix is available in the Android Settings source commit.

Attack Vector

An attacker with physical access to a device that has been factory reset can navigate the Setup Wizard to reach the exposed Settings surface. By interacting with the unprotected AdvancedPowerUsageDetail entry point, the attacker escapes the SUW containment and reaches functionality that should require prior authentication. This leads to local escalation of privilege on the device without user interaction from a legitimate owner.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is publicly available. See the Android Security Bulletin October 2024 for vendor detail.

Detection Methods for CVE-2024-40677

Indicators of Compromise

Devices reporting an active user profile with a build fingerprint predating the October 2024 security patch level after a recent factory reset.
Enterprise-managed Android devices where FRP status does not match expected ownership records.
Unexpected transitions from the Setup Wizard into Settings activities on newly reset devices.

Detection Strategies

Query mobile device management (MDM) inventory for Android builds with a security patch level earlier than 2024-10-01.
Monitor for factory reset events followed by device enrollment or activation using accounts that do not match the previous owner.
Correlate device attestation reports with expected FRP state to identify tampered or bypassed devices.

Monitoring Recommendations

Enforce MDM policies that require the October 2024 or later Android security patch level before granting corporate access.
Log and alert on Android SafetyNet or Play Integrity attestation failures across the fleet.
Review device return and repair workflows for gaps that would let an attacker exploit FRP bypass before re-provisioning.

How to Mitigate CVE-2024-40677

Immediate Actions Required

Apply the Android security patch level 2024-10-01 or later on all supported devices.
Prioritize patching for devices in high-risk physical environments such as retail, field operations, and shared kiosks.
Verify OEM availability of the October 2024 patch for each device model in your inventory and escalate with vendors where patches are delayed.

Patch Information

Google released the fix in the Android Security Bulletin October 2024. The corresponding code change is available in the Android Settings source commit, which adds the missing permission check to shouldSkipForInitialSUW in AdvancedPowerUsageDetail.java. Original equipment manufacturers ship the fix through their own monthly security updates.

Workarounds

No official workaround exists; the missing permission check must be corrected at the platform level.
Restrict physical access to unmanaged or decommissioned Android devices until they receive the October 2024 patch.
Require full-disk encryption and strong lock-screen credentials on all managed devices to reduce the value of an FRP bypass.
Enroll devices in an MDM that enforces minimum patch level and can remotely wipe or lock lost or stolen hardware.

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2024-10-01 or later