Public Exploit Released for Android Zygote CVE-2024-31317

A publicly available proof-of-concept (PoC) deployment kit has been released targeting CVE-2024-31317, a high-severity vulnerability (CVSS 7.8) affecting the Android Zygote process. The vulnerability allows an attacker with low-level privileges and the WRITE_SECURE_SETTINGS permission to perform command injection, leading to full system compromise. The released tool automates the process of generating a reverse shell and injecting it into the Zygote process through the manipulation of the 'hidden_api_blacklist_exemptions' global setting. This affects Android versions 9 through 13. Systems are considered protected if they have applied the June 2024 security patch level or later. The availability of this automated deployment script significantly lowers the barrier for exploitation by malicious actors targeting unpatched Android devices.

Attack Chain

1. Attacker gains initial access to an Android device with low-level privileges.
2. Attacker obtains or already possesses the WRITE_SECURE_SETTINGS permission on the device.
3. Attacker pushes a malicious payload.txt containing the injection string to the /data/local/tmp/ directory.
4. Attacker invokes am force-stop com.android.settings to clear existing settings state.
5. Attacker executes settings put global hidden_api_blacklist_exemptions "$(cat payload.txt)" to trigger the injection vulnerability within the Zygote process context.
6. Attacker executes am start -n com.android.settings/.Settings to force the Zygote process to process the malicious configuration.
7. The reverse shell connects back to the attacker-controlled listener, granting arbitrary command execution with elevated privileges.
8. Attacker reverts the global setting by executing settings put global hidden_api_blacklist_exemptions "null" to attempt to hide the persistence or modification.

Impact

Successful exploitation results in full device compromise, allowing an attacker to bypass security restrictions, access sensitive user data, and execute arbitrary code with elevated system privileges. The vulnerability affects a wide range of Android versions (9-13), placing a large install base at risk if they have not applied the June 2024 security updates.

Recommendation

• Prioritize the deployment of the June 2024 Android Security Patch Level or higher across the device fleet to mitigate CVE-2024-31317.
• Audit devices for applications or processes that have been granted the 'android.permission.WRITE_SECURE_SETTINGS' permission, as this is a core requirement for exploitation.
• Monitor for unexpected execution of shell commands from within /data/local/tmp/, which is a common staging area for exploit payloads on Android.
• Use Mobile Device Management (MDM) solutions to enforce patch compliance and restrict the installation of unauthorized applications or tools that can execute arbitrary shell commands.