November 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 23 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r14 adds the fix for 12 CVEs: CVE-2024-29779, CVE-2024-40660, CVE-2024-43080, CVE-2024-43081, CVE-2024-43083, CVE-2024-43084, CVE-2024-43085, CVE-2024-43086, CVE-2024-43087, CVE-2024-43088, CVE-2024-43089, CVE-2024-43091.

android-security-15.0.0_r2 adds the fix for 3 CVEs: CVE-2024-40660, CVE-2024-43085, CVE-2024-43091.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 1 fix in android-security-14.0.0_r14

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-29779 · platform/system/keymint
  Adds the SetAttestationIdsKM3 (0xc001) legacy Trusty Keymaster message to the is_trusty_provisioning_code and is_trusty_provisioning_req predicates in platform/system/keymint wire/src/legacy.rs, so it is classified as a provisioning request like SetAttestationIds (0xc000).
• CVE-2024-34719 · platform/packages/modules/Bluetooth
  Adds Objects.requireNonNull() on the caller-supplied AttributionSource in four Bluetooth permission-check helpers in Utils.java, so a null AttributionSource can no longer produce a stub attribution chain that checks only Bluetooth's own permissions. It also updates UtilsTest to stop passing null.
• CVE-2024-40660 · platform/frameworks/native
  Makes SurfaceFlinger::setTransactionState sanitize the DisplayState entries in place (iterate by reference over a non-const Vector<DisplayState>) so that permission-stripping applies to the display states actually used, instead of to discarded copies.
• CVE-2024-40661 · platform/packages/modules/Permission
  AdminRestrictedPermissionsUtils.mayAdminGrantPermission now takes the permission group name and no longer returns true early when either the permission itself or any platform permission in its group is an admin-restricted sensor permission. This stops an admin without sensor-grant authority from granting into a sensor permission group through a permission that is not itself on the restricted list.
• CVE-2024-43080 · platform/packages/apps/Settings
  In Settings' AppRestrictionsFragment, the custom restrictions Intent received from an app's broadcast result extras is no longer launched as the raw deserialized object; startActivityForResult is given a fresh copy (new Intent(restrictionsIntent)) instead.
• CVE-2024-43081 · platform/frameworks/base
  InstallPackageHelper.installExistingPackageAsUser now rejects --install-existing requests that carry INSTALL_INSTANT_APP when the target package is a device admin for the user or a protected package, returning INSTALL_FAILED_INVALID_URI as it already did for system and updated-system apps.
• CVE-2024-43083 · platform/packages/modules/Wifi
  Adds input validation in WifiConfigurationUtil.validate() for many previously unchecked WifiConfiguration fields (dhcpServer, defaultGwMacAddress, security params list, Passpoint fields, NetworkSelectionStatus, WEP keys on non-WEP configs, DPP key byte arrays) and makes WifiServiceImpl.addOrUpdateNetwork reject a BSSID allowlist from callers that are not privileged, system or admin.
• CVE-2024-43084 · platform/frameworks/base
  Extends Notification.visitUris so that each Person's own URI (mUri) is visited along with its icon URI, including the senders of MessagingStyle messages, and so that RemoteViews nested inside two list/collection adapter actions are visited, for URI permission grant handling.
• CVE-2024-43085 · platform/frameworks/base
  In UsbDeviceManager's USB function-switch timeout handling, when the current function is FUNCTION_ACCESSORY the fix now calls notifyAccessoryModeExit (which sets FUNCTION_NONE, notifies the permission manager of accessory removal and clears mCurrentAccessory) instead of re-enabling the screen-unlocked default USB functions.
• CVE-2024-43086 · platform/frameworks/base
  Adds an else-if branch to the authenticator validation loop in AccountManagerService so that when a TABLE_META entry (type -> uid) still has an installed uid but the currently registered authenticator for that type belongs to a different uid, the stale type is marked obsolete, its meta row is deleted, and accounts of that type are purged.
• CVE-2024-43087 · platform/packages/apps/Settings
  Removes the deduplication in Settings' AccessibilitySettings that dropped an installed accessibility service from the accessibility preference list whenever an accessibility shortcut activity in the same package had the same label, so every installed service is now listed.
• CVE-2024-43088 · platform/packages/apps/Settings
  Settings AppInfoBase.retrieveAppEntry now calls finish() when the launching intent's EXTRA_USER_HANDLE names a user other than the current one and the initial calling package does not hold INTERACT_ACROSS_USERS_FULL.
• CVE-2024-43089 · platform/packages/providers/MediaProvider
  Adds an enforceCallingPermission(uri, extras, true) call before the shared `break` of the movement switch in MediaProvider.java (visible cases IMAGES_MEDIA_ID, DOWNLOADS_ID, FILES_ID), so that the caller's permissions to do placement are checked before a file rename/move through MediaProvider.update.
• CVE-2024-43091 · platform/external/skia
  In SkEmbossMaskFilter::filterMask the 3-plane 3D mask buffer is now sized with dst->computeTotalImageSize() (0 means too big, so the function aborts) instead of multiplying the single-plane size by 3 without an overflow check.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).