{"id":"ASB-A-309426390","details":"In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-309426390","CVE-2024-0038"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2024-02-01"}]}],"versions":["14-next"],"ecosystem_specific":{"spl":"2024-02-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"116519314751136511221969226786803079531","length":640},"id":"ASB-A-309426390-1256cfcd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java","function":"injectInputEventToInputFilter"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"core/java/android/app/UiAutomationConnection.java"},"deprecated":false,"digest":{"line_hashes":["285194670416646543586882223522832203398","97179566754416015113296328040713934127","220922922656503804254430400451995508609","74950353028803294085503283719744679551"],"threshold":0.9},"id":"ASB-A-309426390-142c5722","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["176962194860844618785882057598313532838","155152601762648187653150601405619582892","90081550450811097636498924400589342963","185808799855466475395217540635472103127"],"threshold":0.9},"id":"ASB-A-309426390-1e43bb5a","signature_type":"Line"},{"id":"ASB-A-309426390-ada22378","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"core/java/android/app/UiAutomationConnection.java","function":"injectInputEventToInputFilter"},"deprecated":false,"digest":{"function_hash":"316784653171314619018305601366287476187","length":102}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309426390.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-02-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2024-02-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["176962194860844618785882057598313532838","155152601762648187653150601405619582892","90081550450811097636498924400589342963","185808799855466475395217540635472103127"]},"id":"ASB-A-309426390-14471fa7","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"core/java/android/app/UiAutomationConnection.java"},"deprecated":false,"digest":{"line_hashes":["285194670416646543586882223522832203398","97179566754416015113296328040713934127","220922922656503804254430400451995508609","74950353028803294085503283719744679551"],"threshold":0.9},"id":"ASB-A-309426390-77726749"},{"target":{"file":"core/java/android/app/UiAutomationConnection.java","function":"injectInputEventToInputFilter"},"deprecated":false,"digest":{"length":102,"function_hash":"316784653171314619018305601366287476187"},"id":"ASB-A-309426390-83c94ca6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313"},{"id":"ASB-A-309426390-ae91b63f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java","function":"injectInputEventToInputFilter"},"deprecated":false,"digest":{"function_hash":"116519314751136511221969226786803079531","length":640}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e83d6c801bb4f97b9b4b54280ac9e1486e622313"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309426390.json"}}],"schema_version":"1.9.0"}