February 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 31 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r5 adds the fix for 8 CVEs: CVE-2024-0030, CVE-2024-0031, CVE-2024-0033, CVE-2024-0035, CVE-2024-0036, CVE-2024-0038, CVE-2024-0040, CVE-2024-0041.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 2 fixes in android-security-14.0.0_r5

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-0030 · platform/packages/modules/Bluetooth
  Clamps the GATT server response length to GATT_MAX_ATTR_LEN and copies only that many bytes in btif_to_bta_response, instead of always copying GATT_MAX_ATTR_LEN bytes and passing through an unchecked length.
• CVE-2024-0031 · platform/packages/modules/Bluetooth
  Adds an early return of nullptr in attp_build_read_by_type_value_cmd when payload_size is less than 5, so the fixed 5-byte ATT header (opcode + start handle + end handle) is never written into a heap buffer sized by a too-small payload_size.
• CVE-2024-0033 · platform/frameworks/native (libs/binder MemoryHeapBase) and platform/system/core (libcutils ashmem-dev memfd backend)
  Adds F_SEAL_GROW | F_SEAL_SHRINK to memfd-backed shared memory created by libbinder MemoryHeapBase(FORCE_MEMFD) and by the libcutils ashmem-dev memfd backend (which also now adds F_SEAL_SEAL when a region is made read-only), so a remote process holding the fd can no longer change the size of the shared region.
• CVE-2024-0035 · platform/frameworks/base
  SystemUI's TileLifecycleManager now overrides ServiceConnection.onNullBinding and calls executeSetBindService(false) so that a TileService returning a null binding is unbound instead of staying bound.
• CVE-2024-0036 · platform/frameworks/base
  In ActivityTaskManagerService.startNextMatchingActivity, the fix makes the launch use ActivityOptions with setAvoidMoveToFront() (creating basic SafeActivityOptions when none were supplied), so the replacement activity cannot bring its task to the foreground. It also wraps the start in try/finally so the cleared Binder identity is always restored.
• CVE-2024-0038 · platform/frameworks/base
  Adds caller checks to the two injectInputEventToInputFilter entry points: UiAutomationConnection now requires a trusted, connected, non-shutdown caller, and AccessibilityManagerService now enforces android.permission.INJECT_EVENTS before forwarding the event to the accessibility input filter.
• CVE-2024-0040 · platform/frameworks/av
  MtpPacket::setParameter now calls allocate(mPacketSize) when it grows mPacketSize, so the buffer is reallocated before putUInt32 writes the parameter at the new offset.
• CVE-2024-0041 · platform/frameworks/base
  Rewrites SystemStatusAnimationSchedulerImpl.removePersistentDot() so that, when the status chip is ANIMATING_OUT, the hide-dot listeners are notified immediately. Before, the notification came from a coroutine that waited for a state change under a DISAPPEAR_ANIMATION_DURATION timeout, and it was silently dropped when the animator callback arrived late.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).