January 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 48 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r4 adds the fix for 8 CVEs: CVE-2023-21245, CVE-2024-0016, CVE-2024-0017, CVE-2024-0018, CVE-2024-0019, CVE-2024-0020, CVE-2024-0021, CVE-2024-0023.

Announced, with no public code

None this month.

Public before it was announced

None this month.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 1 fix in android-security-14.0.0_r4

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-21245 · platform/frameworks/base
  Changes the SIM PIN/PUK shortcut in SystemUI's KeyguardSecurityContainerController so the bouncer is finished only when the target user's security mode is None AND (the lockscreen is disabled for the current user or the target user's setup is incomplete), instead of when the security mode is None OR the lockscreen is disabled.
• CVE-2024-0016 · platform/packages/modules/Bluetooth
  Adds length validation to four HCI BLE event parsers in the Bluetooth stack (BIGInfo advertising report, LE advertising report, LE extended advertising report, LE data length change) so that fixed-size fields and per-report variable data are only read when the received packet actually contains them.
• CVE-2024-0017 · platform/packages/apps/Camera2
  Camera2's CameraActivity.shouldUseNoOpLocation() now returns true (use a no-op location) for a capture intent with no calling package (launched via startActivity rather than startActivityForResult). Otherwise it evaluates Camera2's own package permissions, instead of returning false whenever getCallingPackage() was null.
• CVE-2024-0018 · platform/frameworks/av
  Rewrites the main loop condition in ColorConverter::convertYUV420Planar16ToY410 from `x < src.cropWidth() - 3` to `x + 3 < src.cropWidth()`, so a crop width smaller than 3 no longer wraps the unsigned loop bound and lets the loop run past the source and destination buffers.
• CVE-2024-0019 · platform/frameworks/base
  System UI's AppOpsControllerImpl now queries AppOpsManager.getPackagesForOps for already-running ops when it starts listening, and both SystemStatusAnimationScheduler implementations no longer drop force-visible (privacy) status events during the early-uptime window, so privacy indicators reappear after a System UI restart.
• CVE-2024-0020 · platform/packages/apps/Settings
  Adds a shared RingtonePreference.isValidRingtoneUri() check that rejects picked ringtone content URIs whose embedded userId (content://{userId}@...) belongs to a user that is not a permitted profile of the current user, and applies it in DefaultRingtonePreference.onSaveRingtone and NotificationSoundPreference.onActivityResult.
• CVE-2024-0021 · platform/packages/apps/Settings
  Adds an early exit to Settings' NotificationAccessConfirmationActivity.onCreate so that, when the activity is running in a managed (work) profile, it shows a toast and finishes instead of presenting the dialog that can enable a notification listener service.
• CVE-2024-0023 · platform/frameworks/av
  ConvertRGBToPlanarYUV in Codec2BufferUtils.cpp now bounds its conversion loops by the source view's crop rectangle (src.crop().width/height) instead of the view's full dimensions (src.width()/height()).

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).