March 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 23 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r6 adds the fix for 11 CVEs: CVE-2024-0039, CVE-2024-0045, CVE-2024-0046, CVE-2024-0047, CVE-2024-0048, CVE-2024-0049, CVE-2024-0050, CVE-2024-0051, CVE-2024-0052, CVE-2024-0053, CVE-2024-23717.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

No security tag this month.

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-40081 · platform/frameworks/base
  SystemUI's MediaDataManager now asks UriGrantsManagerService, through a new hidden binder method checkGrantUriPermission_ignoreNonSystem, whether the media app's uid may read a resumable media artwork URI before SystemUI loads that bitmap.
• CVE-2024-0039 · platform/packages/modules/Bluetooth
  Adds running size accounting (size_now) with a CHECK_SIZE guard before every write in attp_build_value_cmd, so the ATT PDU builder frees the buffer and returns nullptr instead of writing past the payload_size-sized allocation. It also widens and validates the Read By Type pair-length field.
• CVE-2024-0045 · platform/packages/modules/Bluetooth
  Adds an SMP command length validation at the start of smp_proc_sec_req in system/stack/smp/smp_act.cc. A Security Request command with an invalid length is now rejected with SMP_INVALID_PARAMETERS instead of being parsed, which addresses an out-of-bounds read when auth_req is read from the payload.
• CVE-2024-0046 · platform/frameworks/base
  Adds a check in the install-existing-package path of InstallPackageHelper so that a request carrying INSTALL_INSTANT_APP is rejected with INSTALL_FAILED_INVALID_URI when the target package is a system app or an updated system app.
• CVE-2024-0047 · platform/frameworks/base
  Three frameworks/base commits make UserManagerService persist device policy global and local user restrictions under distinct XML tags, read the pre-userVersion-10 local restriction format correctly on upgrade, and force DevicePolicyEngine to re-sync global and per-user restriction state into UserManager whenever a DPC sets or clears a user restriction.
• CVE-2024-0048 · platform/frameworks/base
  Schedules a 15 minute MESSAGE_TIMED_OUT message for every AccountManagerService.Session at construction, so that a session still open at timeout runs onTimedOut(), which calls getResponseAndClose() and reports an error to the caller.
• CVE-2024-0049 · platform/frameworks/av
  Adds isValidOMXParam() validation at the start of the six VP8/VP9/Android-VPx OMX get/set parameter handlers in the libstagefright software VPx encoders. When the caller-supplied parameter struct fails validation, they now return OMX_ErrorBadParameter and log a SafetyNet event.
• CVE-2024-0050 · platform/frameworks/av
  Adds isValidOMXParam() validation of the client-supplied DescribeHDR10PlusInfoParams structure in SoftVideoDecoderOMXComponent::getConfig and SoftVideoDecoderOMXComponent::internalSetConfig before the structure is used.
• CVE-2024-0051 · platform/frameworks/av
  Adds an end-of-list check to the outQueue search loop in SoftMPEG4::onQueueFilled. If the current output header is not found, the decoder now returns instead of walking past the end of the output buffer list.
• CVE-2024-0052 · platform/packages/modules/HealthFitness (Health Connect service)
  Makes the Health Connect change-log read path apply the same exercise-route access rules as the normal read path. ExerciseSessionRecord routes returned through getChangeLogs are now limited to the caller's own sessions unless the caller holds READ_EXERCISE_ROUTE.
• CVE-2024-0053 · platform/frameworks/base
  PrintManagerService.getCustomPrinterIcon now checks URI-based custom printer icons returned by a print service and returns null for any icon whose URI encodes a user id whose profile parent is not getCurrentUserId().
• CVE-2024-23717 · platform/packages/modules/Bluetooth
  Removes the p_dev_rec->is_device_authenticated() conjunct from access_secure_service_from_temp_bond() in system/stack/btm/btm_sec.cc. The helper now flags any remote-initiated access to a service requiring incoming authentication from a temporarily bonded device, not only when the device record is already marked authenticated.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).