CVE-2024-43093
Description
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Summary dbcve.org
Android's ExternalStorageProvider contains a path validation bypass in the shouldHideDocument function where incorrect unicode normalization allows attackers to access sensitive directories that should be protected by file path filters, enabling local privilege escalation without additional execution privileges but requiring user interaction.
Mitigation
Apply Android security patches from device vendors/carriers that address CVE-2024-43093; this is a platform-level vulnerability requiring system updates rather than application-level fixes.