{"id":"ASB-A-340239088","details":"In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-340239088","CVE-2024-43762"],"modified":"2026-04-29T15:10:00.007170Z","published":"2024-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/ae43ac7f3d3d5112b0f54b5315a15b08208acf9c"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2024-12-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2024-12-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b"],"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","deprecated":false,"digest":{"function_hash":"187976317115741972041614714852673292330","length":749},"source":"https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"destroyRemoteViewsService"},"signature_version":"v1","id":"ASB-A-340239088-14facee7","match_only_versions":["15-next"]},{"signature_type":"Function","deprecated":false,"digest":{"function_hash":"193368994612042262801535992872175319624","length":1164},"source":"https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"handleNotifyAppWidgetViewDataChanged"},"signature_version":"v1","id":"ASB-A-340239088-2a39374c","match_only_versions":["15-next"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java"},"signature_version":"v1","signature_type":"Line","id":"ASB-A-340239088-47229894","deprecated":false,"digest":{"line_hashes":["7069594906836443799328008215139496556","60083135384786895742289565923807103482","286689668320254275062871083514750716930","303591431841220232289249463434173338719","7069594906836443799328008215139496556","78559963298070788380387444292587698073","185648889765992682205775152283128960783","54659345105254736444109406851216541625"],"threshold":0.9}},{"signature_type":"Line","deprecated":false,"digest":{"line_hashes":["181586260119407969811009303570148090312","140775188422301813884291759520314600283","65163401316593162753490687618165475323","153452361385973064177765830916108503899"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b","target":{"file":"core/java/android/widget/RemoteViewsAdapter.java"},"signature_version":"v1","id":"ASB-A-340239088-8c834e0b","match_only_versions":["15-next"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b","target":{"file":"core/java/android/widget/RemoteViews.java","function":"getItemsFutureFromIntentWithTimeout"},"signature_version":"v1","signature_type":"Function","id":"ASB-A-340239088-ba9d90d2","deprecated":false,"digest":{"function_hash":"53137925773621297524971111119350539002","length":1335}},{"signature_type":"Line","deprecated":false,"digest":{"line_hashes":["149284845035460036026303672698645465529","47798743927130668379148329255077987489","194483828025428132986429193010061122655","313817256377292409827427296624721437259"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/be09d5f691d696ff65428ae99cdcce0d5716277b","target":{"file":"core/java/android/widget/RemoteViews.java"},"signature_version":"v1","id":"ASB-A-340239088-be8cfd9d","match_only_versions":["15-next"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-340239088.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-12-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2024-12-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa"],"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"handleNotifyAppWidgetViewDataChanged"},"signature_version":"v1","signature_type":"Function","id":"ASB-A-340239088-04fdf0a0","deprecated":false,"digest":{"function_hash":"198575482785739048065369166543301105808","length":1092}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java"},"signature_version":"v1","signature_type":"Line","id":"ASB-A-340239088-1df893eb","deprecated":false,"digest":{"line_hashes":["7069594906836443799328008215139496556","60083135384786895742289565923807103482","286689668320254275062871083514750716930","303591431841220232289249463434173338719","7069594906836443799328008215139496556","78559963298070788380387444292587698073","185648889765992682205775152283128960783","54659345105254736444109406851216541625"],"threshold":0.9}},{"signature_type":"Function","deprecated":false,"digest":{"function_hash":"187976317115741972041614714852673292330","length":749},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"destroyRemoteViewsService"},"signature_version":"v1","id":"ASB-A-340239088-7f60444c","match_only_versions":["12"]},{"signature_type":"Line","deprecated":false,"digest":{"line_hashes":["181586260119407969811009303570148090312","140775188422301813884291759520314600283","65163401316593162753490687618165475323","153452361385973064177765830916108503899"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"core/java/android/widget/RemoteViewsAdapter.java"},"signature_version":"v1","id":"ASB-A-340239088-8a94468d","match_only_versions":["12"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-340239088.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2024-12-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa"],"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"handleNotifyAppWidgetViewDataChanged"},"signature_version":"v1","signature_type":"Function","id":"ASB-A-340239088-4d727b51","deprecated":false,"digest":{"function_hash":"198575482785739048065369166543301105808","length":1092}},{"signature_type":"Function","deprecated":false,"digest":{"function_hash":"187976317115741972041614714852673292330","length":749},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"destroyRemoteViewsService"},"signature_version":"v1","id":"ASB-A-340239088-a70f001c","match_only_versions":["12L"]},{"signature_type":"Line","deprecated":false,"digest":{"line_hashes":["181586260119407969811009303570148090312","140775188422301813884291759520314600283","65163401316593162753490687618165475323","153452361385973064177765830916108503899"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"core/java/android/widget/RemoteViewsAdapter.java"},"signature_version":"v1","id":"ASB-A-340239088-a8f2dcd6","match_only_versions":["12L"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java"},"signature_version":"v1","signature_type":"Line","id":"ASB-A-340239088-fe0d7285","deprecated":false,"digest":{"line_hashes":["7069594906836443799328008215139496556","60083135384786895742289565923807103482","286689668320254275062871083514750716930","303591431841220232289249463434173338719","7069594906836443799328008215139496556","78559963298070788380387444292587698073","185648889765992682205775152283128960783","54659345105254736444109406851216541625"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-340239088.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2024-12-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa"],"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","deprecated":false,"digest":{"function_hash":"187976317115741972041614714852673292330","length":749},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"destroyRemoteViewsService"},"signature_version":"v1","id":"ASB-A-340239088-2f4526a9","match_only_versions":["13"]},{"signature_type":"Line","deprecated":false,"digest":{"line_hashes":["181586260119407969811009303570148090312","140775188422301813884291759520314600283","65163401316593162753490687618165475323","153452361385973064177765830916108503899"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"core/java/android/widget/RemoteViewsAdapter.java"},"signature_version":"v1","id":"ASB-A-340239088-abf0264a","match_only_versions":["13"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java"},"signature_version":"v1","signature_type":"Line","id":"ASB-A-340239088-f47e5423","deprecated":false,"digest":{"line_hashes":["7069594906836443799328008215139496556","60083135384786895742289565923807103482","286689668320254275062871083514750716930","303591431841220232289249463434173338719","7069594906836443799328008215139496556","78559963298070788380387444292587698073","185648889765992682205775152283128960783","54659345105254736444109406851216541625"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"handleNotifyAppWidgetViewDataChanged"},"signature_version":"v1","signature_type":"Function","id":"ASB-A-340239088-f585fad9","deprecated":false,"digest":{"function_hash":"198575482785739048065369166543301105808","length":1092}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-340239088.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-12-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2024-12-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa"],"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java"},"signature_version":"v1","signature_type":"Line","id":"ASB-A-340239088-9b33c48e","deprecated":false,"digest":{"line_hashes":["7069594906836443799328008215139496556","60083135384786895742289565923807103482","286689668320254275062871083514750716930","303591431841220232289249463434173338719","7069594906836443799328008215139496556","78559963298070788380387444292587698073","185648889765992682205775152283128960783","54659345105254736444109406851216541625"],"threshold":0.9}},{"signature_type":"Function","deprecated":false,"digest":{"function_hash":"187976317115741972041614714852673292330","length":749},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"destroyRemoteViewsService"},"signature_version":"v1","id":"ASB-A-340239088-d840337f","match_only_versions":["14"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java","function":"handleNotifyAppWidgetViewDataChanged"},"signature_version":"v1","signature_type":"Function","id":"ASB-A-340239088-d89ed705","deprecated":false,"digest":{"function_hash":"198575482785739048065369166543301105808","length":1092}},{"signature_type":"Line","deprecated":false,"digest":{"line_hashes":["181586260119407969811009303570148090312","140775188422301813884291759520314600283","65163401316593162753490687618165475323","153452361385973064177765830916108503899"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/13e092573bce88580a2ddf4c289afa646f839cfa","target":{"file":"core/java/android/widget/RemoteViewsAdapter.java"},"signature_version":"v1","id":"ASB-A-340239088-e7af8ba1","match_only_versions":["14"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-340239088.json"}}],"schema_version":"1.7.5"}