CVE-2024-34734: 
NixOS vulnerability analysis and mitigation

CVE-2024-34734 is a security vulnerability discovered in Android's FooterActionsViewModel.kt component, specifically in the onForegroundServiceButtonClicked function. The vulnerability was disclosed on August 15, 2024, affecting Android versions 13.0 and 14.0. The issue stems from an insecure default value that could allow disabling active VPN applications from the lockscreen (NVD, CIS Advisory).

The vulnerability exists in the onForegroundServiceButtonClicked function of FooterActionsViewModel.kt, where an insecure default value could allow unauthorized access to VPN controls from the lockscreen. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-1188 (Insecure Default Initialization of Resource) (NVD).

Successful exploitation of this vulnerability could lead to local escalation of privilege, allowing an attacker to disable active VPN applications from the lockscreen. This could compromise the security and privacy of the device's network communications, as the VPN protection could be bypassed without proper authentication (NVD).

The vulnerability requires local access to the device but does not need additional execution privileges for exploitation. No user interaction is required for exploitation, making it particularly concerning from a security perspective (NVD).

Google has addressed this vulnerability in the Android security patch level 2024-08-05. The fix involves modifying the behavior to prevent showing the active apps dialog when the screen is locked, instead prompting the user to unlock the device first. The dialog will only open after successful unlock (Android Patch).