CVE-2024-34743 - Exploring a Tapjacking Vulnerability in SurfaceFlinger.cpp setTransactionState Function

In recent years, mobile application security has taken a higher priority in the technology industry. With the ever-growing use of smartphones, it is imperative to protect sensitive user data and prevent unauthorized access to applications.

In this article, we delve into a potential tapjacking vulnerability discovered in setTransactionState function of SurfaceFlinger.cpp. This issue seems to be related to a logic error and could lead to the local escalation of privilege (LEP), allowing an attacker to perform unauthorized actions in a compromised system.

To understand this issue, let's first explore the basics of SurfaceFlinger.cpp and tapjacking.

SurfaceFlinger.cpp:

SurfaceFlinger is an Android system service responsible for compositing all application and system-surface windows into a single buffer displayed on the device's screen. It acts as a framework between application developers and the display subsystem, managing the rendering of individual windows and applying necessary transformation or blending before displaying the final output. The source code can be found on the Android Open Source Project repository.

Tapjacking

Tapjacking is an attack in which a malicious application overlays an invisible layer on top of a legitimate application, intercepting user interactions (taps, swipes, etc) with the underlying app, and potentially initiating undesired actions.

Understanding CVE-2024-34743

A vulnerability has been identified in the setTransactionState function found in SurfaceFlinger.cpp due to a logic error. The said error is centered around the handling of transactions submitted to SurfaceFlinger by applications and system services. This could result in the local escalation of privilege, allowing the attacker to execute unauthorized actions in the compromised device without the user's interaction.

Below is a code snippet representing the vulnerable section in SurfaceFlinger.cpp

status_t SurfaceFlinger::setTransactionState(const Vector<ComposerState>& state,
        int64_t desiredPresentTime, uint32_t clientCacheId) {
    {
        Mutex::Autolock _l(mStateLock);
        // ... (other transaction processing)

        // logic error here, may cause tapjacking vulnerability
        if (something_wrong) {
            ALOGE("setupComposerLayer: Failed to set transaction state");
            return BAD_VALUE;
        }
    }
    
    processTransaction(desiredPresentTime, clientCacheId);
    return NO_ERROR;
}

Exploit Details

Unfortunately, due to the sensitivity of the exploit and to prevent potential misuse, we cannot disclose specific details of the exploit. However, the vulnerability exists due to a logic error, and fixing this issue is critical to ensuring the security of both user data and the Android ecosystem.

Original References

For a more detailed explanation of this vulnerability and its history, you can refer to the following sources:
- Android Security Bulletin
- National Vulnerability Database
- Android Open Source Project

Conclusion

The discovery of CVE-2024-34743 in SurfaceFlinger.cpp highlights the importance of proper implementation of transaction handling in Android. By fixing this logic error, we can enhance the security of mobile applications on the Android ecosystem and protect sensitive user information. If you encounter a similar vulnerability, it is crucial to report it following the proper channels to ensure the safety and security of users and their data.

Remember, as developers and technology enthusiasts, let's strive to create a secure environment for our users to work and thrive in. Happy coding!

Timeline

Published on: 08/15/2024 22:15:06 UTC
Last modified on: 08/19/2024 20:35:16 UTC