Android Settings App Elevation of Privilege Vulnerability

A vulnerability in the Android Settings application allows for a local elevation of privilege by bypassing factory reset protections. This issue arises from a missing permission check in the 'shouldSkipForInitialSUW' method of 'AdvancedPowerUsageDetail.java'. Exploitation of this vulnerability does not require any additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized access to elevated privileges, allowing a user to perform actions or access resources that are normally restricted.

Reproduction

To reproduce this vulnerability, initiate a factory reset on the device. Once the reset is complete, use ADB (Android Debug Bridge) to launch the app battery usage information page. The app should close automatically, indicating that the factory reset protection bypass has been successful.

Remediation

Users can update their devices to the October 2024 security patch level to address this vulnerability.