CVE-2024-31323

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1021CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-313247.3In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode firsCVE-2024-313257.8In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code. This could lead to localCVE-2024-313267.8In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic error in the code. This CVE-2024-313277.0In multiple functions of MessageQueueBase.h, there is a possible out of bounds write due to a race condition. This could lead to local escalCVE-2024-313288.8In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on thCVE-2024-313317.3In setMimeGroup of PackageManagerService.java, there is a possible way to hide the service from Settings due to a logic error in the code. TCVE-2024-313327.8In multiple locations, there is a possible way to bypass a restriction on adding new Wi-Fi connections due to a missing permission check. ThCVE-2024-313337.8In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalaCVE-2024-313347.8In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This coCVE-2024-313357.8In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lCVE-2024-313367.8In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper input validation. This CVE-2024-313377.8In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local
CVE-2024-31323: High severity, CVSS 7.8 | Vulnix