August 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 32 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r11 adds the fix for 10 CVEs: CVE-2024-34727, CVE-2024-34731, CVE-2024-34734, CVE-2024-34736, CVE-2024-34737, CVE-2024-34738, CVE-2024-34740, CVE-2024-34741, CVE-2024-34742, CVE-2024-34743.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

No security tag this month.

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-20971 · platform/frameworks/base
  Adds a missing early return in PermissionManagerServiceImpl.removePermission() so that a non-dynamic permission is no longer removed from the registry after the "Not allowed to modify non-dynamic permission" check fails.
• CVE-2024-34727 · platform/packages/modules/Bluetooth
  Adds discovery-attribute length checks to sdpu_compare_uuid_with_attr (system/stack/sdp/sdp_utils.cc). A UUID is now compared with a tSDP_DISC_ATTR only when SDP_DISC_ATTR_LEN matches the UUID size (2, 4 or 16 bytes). Otherwise the function logs an error and returns false.
• CVE-2024-34731 · platform/frameworks/av (media/module/libmediatranscoding TranscodingResourcePolicy); platform/hardware/interfaces (health/aidl/default Health/LinkedCallback
  Replaces raw object pointers used as libbinder_ndk death-recipient cookies with tracked, validated cookie objects (keyed maps, weak_ptr wrappers, onUnlinked-owned cookies) in libmediatranscoding, the health AIDL HAL default impl, the neuralnetworks AIDL utils and keystore2 apc_compat, so a late binderDied callback no longer dereferences a freed object.
• CVE-2024-34734 · platform/frameworks/base
  SystemUI's Quick Settings footer now routes the "active apps" (foreground services) button click through ActivityStarter.dismissKeyguardThenExecute, so the foreground services dialog opens only after the keyguard is dismissed instead of opening directly while the screen is locked.
• CVE-2024-34736 · platform/frameworks/av
  StagefrightRecorder::setupVideoEncoder now forces zero B-layers (bLayers = 0) in the temporal-layering "ts-schema" when the audio source is AUDIO_SOURCE_MIC and the video source is VIDEO_SOURCE_SURFACE, which disables B-frame layering for the screen-recorder-with-microphone use case.
• CVE-2024-34737 · platform/frameworks/base
  Adds a CountQuotaTracker to ActivityClientController so that an app may change the PiP aspect ratio via setPictureInPictureParams/enterPictureInPictureMode at most 60 times per minute; excess requests throw IllegalStateException.
• CVE-2024-34738 · platform/frameworks/base
  AppOpsService now filters restricted-read app ops out of collectOps() results unless the caller holds GET_APP_OPS_STATS, and verifyIncomingOp() accepts any of MANAGE_APPOPS, GET_APP_OPS_STATS or MANAGE_APP_OPS_MODES instead of only MANAGE_APPOPS for restricted ops.
• CVE-2024-34740 · platform/frameworks/libs/modules-utils (BinaryXmlSerializer)
  BinaryXmlSerializer.attributeBytesHex and attributeBytesBase64 now throw IOException when the byte array is longer than 65535 (MAX_UNSIGNED_SHORT) instead of writing a truncated 16-bit length followed by the full payload; a later commit linked by the same bug id caps the checksum signature in ApkChecksums.verifySignature at 35 * 1024 bytes.
• CVE-2024-34741 · platform/frameworks/base
  WindowState.setForceHideNonSystemOverlayWindowIfNeeded now classifies a window by getBaseType() instead of mAttrs.type. Per the commit title 'Hide SAW subwindows', this means subwindows of system-alert-window (SAW) or toast parents are also force-hidden when a top window hides overlays through Window#setHideOverlayWindows.
• CVE-2024-34742 · platform/frameworks/base
  Makes DeviceOwnerReadWriter.shouldWrite() in OwnersData always return true, so the device owner persistence file (device_owners2.xml) is always written. Before, it was written only when a device owner, system update policy or system update info was set.
• CVE-2024-34743 · platform/frameworks/native
  Changes the sanitization loop in SurfaceFlinger::setTransactionState to iterate ComposerState entries by reference (auto&) instead of by value, so layer_state_t::sanitize(permissions) actually strips privileged fields from the states that are later applied.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).