{"id":"ASB-A-329230490","details":"In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-329230490","CVE-2024-31320"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-07-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-07-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/9722ce9d733edab76163fbcd21b231424e3d7061"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/df49e0e3083b0707e2cca5a5956b49f14ded078e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-07-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2024-07-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-329230490-5add1a57","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/56ac420b653da3f716f37a77780d7a74bc5fc439","target":{"file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false,"digest":{"line_hashes":["283533769886380923448576656925363146498","306640430079475523562921556048505603680","220247844284439815336487099373551580211","296340939658799727884616528029234346770"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/71418ecfa539b99d9bb0053d1de5060040bdf02f","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false,"digest":{"line_hashes":["67950038913822548496977403571025662121","222725767583171763006265824348111716351","286500330299365691393581685729299877668","166044803054551522655759985343015696389","151376619027520813586001682013091186310","194068989226376155571126814800988254819","257382018809139542673220738604381729552"],"threshold":0.9},"id":"ASB-A-329230490-6b902821","signature_type":"Line"},{"id":"ASB-A-329230490-a4ce043d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/56ac420b653da3f716f37a77780d7a74bc5fc439","target":{"file":"core/java/android/companion/AssociationRequest.java","function":"setSkipPrompt"},"deprecated":false,"digest":{"length":55,"function_hash":"168892350902793353495994525992132626819"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/71418ecfa539b99d9bb0053d1de5060040bdf02f","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"associate"},"deprecated":false,"digest":{"function_hash":"37463952415737052809221431915743857188","length":1588},"id":"ASB-A-329230490-a592a235","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/56ac420b653da3f716f37a77780d7a74bc5fc439","https://android.googlesource.com/platform/frameworks/base/+/71418ecfa539b99d9bb0053d1de5060040bdf02f"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329230490.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-07-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/be2e3b05858ba7a6349f5487d2658d00853b11cd","https://android.googlesource.com/platform/frameworks/base/+/f28e88e53d57779fff5900d1811ffa07ab174640"],"severity":"Critical","spl":"2024-07-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["283533769886380923448576656925363146498","306640430079475523562921556048505603680","220247844284439815336487099373551580211","296340939658799727884616528029234346770"],"threshold":0.9},"id":"ASB-A-329230490-2e9d0f69","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/be2e3b05858ba7a6349f5487d2658d00853b11cd","target":{"file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f28e88e53d57779fff5900d1811ffa07ab174640","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false,"digest":{"line_hashes":["67950038913822548496977403571025662121","222725767583171763006265824348111716351","286500330299365691393581685729299877668","166044803054551522655759985343015696389","151376619027520813586001682013091186310","194068989226376155571126814800988254819","257382018809139542673220738604381729552"],"threshold":0.9},"id":"ASB-A-329230490-3f23a8b1","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f28e88e53d57779fff5900d1811ffa07ab174640","target":{"function":"associate","file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false,"digest":{"length":1683,"function_hash":"65861310754994395892854568185787642004"},"id":"ASB-A-329230490-8ac5bf9f","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/be2e3b05858ba7a6349f5487d2658d00853b11cd","target":{"file":"core/java/android/companion/AssociationRequest.java","function":"setSkipPrompt"},"deprecated":false,"digest":{"function_hash":"168892350902793353495994525992132626819","length":55},"id":"ASB-A-329230490-f8035f09","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329230490.json"}}],"schema_version":"1.9.0"}