CVE-2023-40094

What it actually does

Missing permission check in keyguardGoingAway of ActivityTaskManagerService.java enables lock screen bypass leading to local privilege escalation without additional privileges or user interaction.

Why it matters to the business

Local attackers can gain full control of affected devices, exposing sensitive data and allowing unauthorized operations; while EPSS remains low and no KEV listing exists, the 1047 days since publication and presence in downstream ecosystems increase long-term exposure risk for organizations relying on the affected components.

How an attack unfolds

An attacker with local access invokes the vulnerable keyguardGoingAway path to bypass authentication checks and obtain elevated privileges on the device.

How to fix it

Upgrade affected packages to fixed versions; for org.apache.hive/hive-jdbc update to 4.0.0 or later. Apply vendor patches promptly given the 1047-day window since publication.

How to confirm the fix worked

Verify package versions against fixed releases, review permission checks around ActivityTaskManagerService, and confirm lock screen enforcement in updated builds.

Typical attack path

1. Gain local access to the target device
2. Invoke ActivityTaskManagerService.keyguardGoingAway without required permissions
3. Bypass lock screen authentication
4. Escalate to full device privileges

How to detect it

Review system logs for unexpected keyguard transitions or privilege changes; examine ActivityTaskManagerService calls in application or system traces for signs of bypass attempts.

What your security team should do

• Prioritize upgrade of org.apache.hive/hive-jdbc to 4.0.0
• Audit local privilege boundaries in Android-based or dependent systems
• Monitor for any future EPSS increases or threat actor adoption