{"vulnerability": "CVE-2024-31317", "sightings": [{"uuid": "07aa489d-3797-45ed-820f-12966d9cfbad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "MISP/b5cbc36d-3fcd-45dc-9fd3-57a1ee49d407", "content": "", "creation_timestamp": "2024-07-27T11:08:57.000000Z"}, {"uuid": "68650010-74e4-4afd-9395-7d2e8dcd8824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://gist.github.com/ybtag/db3f3595139556c773fb94b7cbe668b5", "content": "", "creation_timestamp": "2025-01-08T19:43:21.000000Z"}, {"uuid": "077be309-d194-4295-80e9-11f129fd687e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "exploited", "source": "https://gist.github.com/1eo1/8f09db251b425ffd539f2a936c0698b3", "content": "", "creation_timestamp": "2025-02-18T11:57:27.000000Z"}, {"uuid": "e2afc89b-8e16-4192-86e0-f37646dd13b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://rtx.meta.security/exploitation/2024/06/03/Android-Zygote-injection.html", "content": "", "creation_timestamp": "2025-02-18T12:43:36.537339Z"}, {"uuid": "ee0c2495-7cb2-4f9d-a121-82c31d923089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://gist.github.com/javaeryang/ae6ed32ceb621c1e281ee5880b9effef", "content": "", "creation_timestamp": "2025-11-13T09:16:36.000000Z"}, {"uuid": "2b2d2b33-b4f9-438d-aa81-c6076403601e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "Telegram/GKw6KWu74hDM5ChLJJmVxv5UVQ8gqkAeQo71ShuHxpLjmP0", "content": "", "creation_timestamp": "2025-12-21T15:00:08.000000Z"}, {"uuid": "9bdaee84-9977-46c7-bc52-e3c286905bd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "Telegram/c9mxF0xUgnweIqFG-7qFhNjFM98zK9XRzRCqE5Wws_VSdzI", "content": "", "creation_timestamp": "2025-11-21T21:00:05.000000Z"}, {"uuid": "6002b183-21cd-44df-8ed4-3576fd35ef98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/9311", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-31317\nURL\uff1ahttps://github.com/fuhei/CVE-2024-31317\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-12-04T12:39:32.000000Z"}, {"uuid": "276d28b6-9611-453c-b5d8-2ebb12adda79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "Telegram/Q-FUU-lAutYI3jEoV8acSdppz6zQVwroodkszDoVVVD_xOQ", "content": "", "creation_timestamp": "2025-04-17T23:00:05.000000Z"}, {"uuid": "c9acd579-cbd9-437c-851a-4f2b84ae3aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "Telegram/XQnuNd5X8XmOjKF9F0Yu3FlXocPy2dUR7xXCx3NP2hXIbzk", "content": "", "creation_timestamp": "2025-04-26T23:00:05.000000Z"}, {"uuid": "39a399c5-1ae5-4a35-b002-a18af6deaa55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "https://t.me/androidMalware/2243", "content": "Becoming any Android app via Zygote command injection (CVE-2024-31317)\nhttps://rtx.meta.security/exploitation/2024/06/03/Android-Zygote-injection.html", "creation_timestamp": "2024-08-24T01:38:30.000000Z"}, {"uuid": "9061a4f7-cf6b-42f7-9f96-ca1895ec2a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11026", "content": "#exploit\n1. CVE-2024-38148:\nWindows Secure Channel RCE\nhttps://v-v.space/2024/08/19/CVE-2024-38148\n\n2. CVE-2024-31317:\nhttps://blog.flanker017.me/the-new-mystique-bug-cve-2024-31317\n\n3. CVE-2024-29050:\nWindows Cryptographic Services RCE\nhttps://v-v.space/2024/08/23/CVE-2024-29050", "creation_timestamp": "2024-08-23T22:17:53.000000Z"}, {"uuid": "dbbc725e-eabe-4108-a87e-aef3345d8d3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "https://t.me/Rootsec_2/4212", "content": "#exploit\n1. CVE-2024-38148:\nWindows Secure Channel RCE\nhttps://v-v.space/2024/08/19/CVE-2024-38148\n\n2. CVE-2024-31317:\nhttps://blog.flanker017.me/the-new-mystique-bug-cve-2024-31317\n\n3. CVE-2024-29050:\nWindows Cryptographic Services RCE\nhttps://v-v.space/2024/08/23/CVE-2024-29050", "creation_timestamp": "2024-08-23T13:29:53.000000Z"}, {"uuid": "7089f154-8866-4f53-be0b-40616a96ff59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "Telegram/p1UsK7gFrFQLGfOF3xir9AjmdpIuUDbHtmKFPqLrJn2rk0E", "content": "", "creation_timestamp": "2026-05-29T15:00:07.000000Z"}, {"uuid": "cdd3ee2a-5122-47ac-96e2-3c2c01770488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "Telegram/GUVwrz9b9Ug_knDvSUJf3Tbi3zEtQJMShrvy8E-4r1bK888", "content": "", "creation_timestamp": "2026-07-16T19:00:26.819999Z"}, {"uuid": "1d529c28-4c02-4b26-9fad-f936ea6c4419", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "Telegram/GUVwrz9b9Ug_knDvSUJf3Tbi3zEtQJMShrvy8E-4r1bK888", "content": "", "creation_timestamp": "2026-07-17T00:00:43.251505Z"}, {"uuid": "c81f8c27-b27d-484d-9908-4ae5279a09c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "published-proof-of-concept", "source": "Telegram/GUVwrz9b9Ug_knDvSUJf3Tbi3zEtQJMShrvy8E-4r1bK888", "content": "", "creation_timestamp": "2026-07-18T00:00:08.283233Z"}, {"uuid": "63c11b38-1b83-459b-9e2f-e6fd2e514347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://t.me/pphm_HackerNews/28", "content": "\ud83d\udd34 The Android Zygote Processor Critical vulnerability CVE-2024-31317\n\nThe main issue is that the permission of any UID in the Android system can be obtained by using this vulnerability, which is similar to breaking through the Android sandbox and obtaining the permission of any app. This vulnerability has somehow similar features to that which was awarded in Hack OscarPwnie ceremony, but each one has its own results.", "creation_timestamp": "2026-07-20T22:00:05.175057Z"}, {"uuid": "b5e5513d-4ce4-4ccf-b173-413ce24eccc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://t.me/pphm_HackerNews/28", "content": "\ud83d\udd34 The Android Zygote Processor Critical vulnerability CVE-2024-31317\n\nThe main issue is that the permission of any UID in the Android system can be obtained by using this vulnerability, which is similar to breaking through the Android sandbox and obtaining the permission of any app. This vulnerability has somehow similar features to that which was awarded in Hack OscarPwnie ceremony, but each one has its own results.", "creation_timestamp": "2026-07-21T01:00:06.002660Z"}, {"uuid": "bd7829e9-c814-4e46-9774-b94eef05c002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://gist.github.com/H3XDaemon/47b44057c0d70721380fbf33f2c4d496", "content": "# Technical Advisory: System Settings Persistence Failure via 64KB UTF-8 Serialization Overflow in OxygenOS / ColorOS\n\n**Component:** `frameworks/base/packages/SettingsProvider` / `com.android.providers.settings.SettingsState`  \n**Affected Platforms:** OxygenOS 13.x / ColorOS 13.x (Android 13, Snapdragon 865 / SM8250 platform tested)  \n**Impact:** Complete breakdown of `Settings.Secure` disk persistence; all user-configured settings revert upon system reboot.\n\n---\n\n## 1. Executive Summary\n\nOn certain OxygenOS/ColorOS firmware releases, modifications made to system settings (including `timepower_config`, display timeout, accessibility, and security preferences) revert to default values after a device reboot. \n\nInitial triage often misattributes this issue to third-party Xposed/LSPosed hooks, corrupt SQLite databases, or read-only filesystem mounts. Empirical tracing reveals the true root cause: an uncaught `java.io.UTFDataFormatException` within `SettingsState.doWriteState()`, triggered when a single OEM setting entry exceeds the 65,535-byte serialization limit enforced by Java's `FastDataOutput.writeUTF()` implementation.\n\nThis document details the serialization failure mechanism, traces the specific OEM string leakage key (`op_sysui_qs_tiles_hide`), and provides a non-destructive remediation procedure.\n\n---\n\n## 2. Technical Root Cause Analysis\n\n### 2.1 Java 64 KB UTF-8 Serialization Boundary Violation\nAndroid's `SettingsProvider` maintains in-memory setting tables (`system`, `secure`, `global`) that are periodically flushed to disk at `/data/system/users/0/settings_*.xml`.\n\nDuring XML binary/text serialization, `com.android.internal.util.FastDataOutput.writeUTF()` serializes string attributes. Java's Modified UTF-8 specification encodes string length as an unsigned 16-bit integer (`u2`), capping the maximum string length at **65,535 bytes**:\n\n$$\\text{Max UTF-8 Length} = 2^{16} - 1 = 65,535 \\text{ bytes}$$\n\nIf a single setting string exceeds 65,535 bytes, the length calculation overflows to a negative integer value. `FastDataOutput.writeUTF()` throws a `UTFDataFormatException`:\n\n```text\nE SettingsState: Failed to write settings, restoring backup\nE SettingsState: java.io.IOException: Modified UTF-8 length too large: -66142\n    at com.android.internal.util.FastDataOutput.writeUTF(FastDataOutput.java:167)\n    at com.android.internal.util.BinaryXmlSerializer.attribute(BinaryXmlSerializer.java:209)\n    at com.android.providers.settings.SettingsState.setValueAttribute(SettingsState.java:991)\n    at com.android.providers.settings.SettingsState.writeSingleSetting(SettingsState.java:968)\n    at com.android.providers.settings.SettingsState.doWriteState(SettingsState.java:853)\n```\n\n### 2.2 OEM SystemUI String Concatenation Memory Leak\nInspection of `Settings.Secure` revealed an OEM-specific key:\n- **Key:** `op_sysui_qs_tiles_hide`\n- **Measured String Length:** 66,165 characters\n- **Target Package:** `/system_ext/priv-app/SystemUI/SystemUI.apk` (`classes.dex`)\n- **Disassembled Class:** `Lcom/android/systemui/qs/QSTileHost$OperatorCustom$HideTileBroadcastReceiver;` (Class Def #5093, Bytecode Offsets: `0x51d9a2`, `0x51dd12`)\n\n**Mechanism:** OxygenOS/ColorOS SystemUI dynamically updates `op_sysui_qs_tiles_hide` when tile visibility changes (e.g., Wi-Fi Calling status updates, SIM card state transitions, or Quick Settings customization). Within `QSTileHost$OperatorCustom$HideTileBroadcastReceiver.onReceive()`, string updates lack a deduplication check (`.contains()`). Tile package strings are repeatedly appended:\n\n$$\\text{Key Value} = \\text{Key Value}_{\\text{existing}} + \\text{\",\"} + \\text{Tile Package Name}$$\n\nOver extended device usage, the string size eventually passes the 65,535-byte threshold.\n\n### 2.3 Transaction Abort and Disk Persistence Lockout\nWhen any key in `Settings.Secure` is modified (via the Settings GUI or ADB), `SettingsState` schedules a batch write to disk. \n\nWhen serialization reaches the oversized `op_sysui_qs_tiles_hide` entry, `FastDataOutput.writeUTF()` throws `UTFDataFormatException`. `SettingsState` catches the exception, aborts the write transaction, and restores `/data/system/users/0/settings_secure.xml` from the backup file on disk.\n\nConsequently:\n1. In-memory changes persist only for the duration of the current boot session.\n2. The physical disk file `/data/system/users/0/settings_secure.xml` is never updated.\n3. Upon reboot, `SettingsProvider` reloads the stale XML file from disk, discarding all user modifications.\n\n### 2.4 Secondary Hardware Alarm State Desynchronization\nFor scheduled power configurations (`timepower_config`), OxygenOS maintains a system property:\n- `persist.sys.poweralarm.time` (Unix epoch timestamp in milliseconds).\n\nBecause `SettingsState` fails to commit the updated `timepower_config` to disk, `persist.sys.poweralarm.time` retains a legacy timestamp (e.g., `1785020404000`, corresponding to 07:00 AM). On system boot, `init` reloads `persist.sys.poweralarm.time`, and `com.qualcomm.qti.poweroffalarm` re-injects the 07:00 AM power-on alarm into `SettingsProvider`, enforcing a persistent state loop.\n\n---\n\n## 3. Diagnostic Protocol\n\n### 3.1 Logcat Inspection\nFilter system logs for serialization failures within `SettingsState`:\n\n```bash\nadb shell \"su -c 'logcat -d | grep -i SettingsState'\"\n```\n\nLook for the following signature:\n```text\nE SettingsState: Failed to write settings, restoring backup : Modified UTF-8 length too large\n```\n\n### 3.2 Key Length Inspection\nIdentify keys exceeding byte limits using Python over ADB:\n\n```bash\npython -c \"import subprocess; out=subprocess.check_output(['adb', 'shell', 'settings list secure']).decode('utf-8', errors='ignore'); [print(line[:80], '-> len=', len(line)) for line in out.splitlines() if len(line) > 1000]\"\n```\n\n---\n\n## 4. Remediation Procedure\n\nExecute the following commands in an elevated root shell (`su`) to remove the corrupted entry and clear hardware property locks.\n\n### Step 1: Remove the Oversized Setting Entry\n```bash\nadb shell \"su -c 'settings delete secure op_sysui_qs_tiles_hide'\"\n```\n\n### Step 2: Clear Stale Hardware Alarm Properties\n```bash\nadb shell \"su -c 'setprop persist.sys.poweralarm.time 0'\"\nadb shell \"su -c 'setprop sys.power_off_alarm 0'\"\n```\n\n### Step 3: Write Target Settings Entry\n```bash\nadb shell \"su -c 'settings put secure timepower_config 070000127230000127'\"\n```\n\n---\n\n## 5. Verification\n\n### 5.1 Pre-Reboot Disk State Verification\nConfirm that `SettingsState` successfully serializes to disk without throwing exceptions:\n\n```bash\nadb shell \"su -c 'strings /data/system/users/0/settings_secure.xml | grep -A 2 -B 2 timepower_config'\"\n```\n\n*Expected Output:* The target string `070000127230000127` is present in `settings_secure.xml`.\n\n### 5.2 Post-Reboot Verification\nReboot the device:\n\n```bash\nadb reboot\n```\n\nAfter boot completion, query the setting and property states:\n\n```bash\nadb shell settings get secure timepower_config\n# Expected: 070000127230000127\n\nadb shell getprop persist.sys.poweralarm.time\n# Expected: 0\n```\n\n---\n\n## 6. References & Related Research\n\n1. **AOSP Issue Tracker & FastDataOutput Specification**:\n   `com.android.internal.util.FastDataOutput.writeUTF()` implementation details and unsigned 16-bit string length boundaries.\n2. **CVE-2024-31317 Research / PoC**:\n   `SettingsState` denial-of-service vector triggered via intentionally oversized string attributes in `SettingsProvider`.\n   Reference Gist: `https://gist.github.com/rabits/eef4fad0bd024786a3afde2bc1f32b7e`\n", "creation_timestamp": "2026-07-25T12:26:12.152179Z"}]}