CVE-2024-40659

In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

• CWE-120

• https://android.googlesource.com/platform/packages/modules/RemoteKeyProvisioning/+/c65dce4c6d8d54e47dce79a56e29e2223a2354e6Mailing List, Patch
• https://source.android.com/security/bulletin/2024-09-01Patch, Vendor Advisory

Published

Sep 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40653In multiple functions of ConnectionServiceWrapper.java, ther…7.3
• CVE-2024-40654In multiple locations, there is a possible permission bypass…7.8
• CVE-2024-40655In bindAndGetCallIdentification of CallScreeningServiceHelpe…7.8
• CVE-2024-40656In handleCreateConferenceComplete of ConnectionServiceWrappe…5.5
• CVE-2024-40657In addPreferencesForType of AccountTypePreferenceLoader.java…7.8
• CVE-2024-40658In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a…7.8
• CVE-2024-4066A vulnerability classified as critical has been found in Ten…8.8
• CVE-2024-40660In setTransactionState of SurfaceFlinger.cpp, there is a pos…7.8
• CVE-2024-40661In mayAdminGrantPermission of AdminRestrictedPermissionsUtil…7.8
• CVE-2024-40662In scheme of Uri.java, there is a possible way to craft a ma…7.8
• CVE-2024-40664In setupAccessibilityServices of AccessibilityFragment.java …6.2
• CVE-2024-40669In TBD of TBD, there is a possible use after free due to a r…8.4