CVE-2024-0044 — Injection in Frameworks Base

CWE-74 — InjectionCWE-75 — Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)3 documents3 sources
Severity
6.7MEDIUMNVD
EPSS
9.2%
top 7.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedMar 11
Latest updateOct 1

Description

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages4 packages

▶Androidplatform/frameworks_base15-next:0 — 15-next:2024-10-01+4
▶CVEListV5google/android5 versions+4
▶NVDgoogle/android4 versions+3

Patches

Patch: android.googlesource.com ↗

🔴Vulnerability Details

1
OSV
CVE-2024-0044: In createSessionInternal of PackageInstallerService↗2024-10-01
▶

📋Vendor Advisories

1
Android
CVE-2024-0044: Android Security Bulletin 2024-10-01 CVE: CVE-2024-0044 Severity: HIGH Type: EoP Affected AOSP versions: 12, 12L, 13, 14, 15 References: A-307532206 [↗2024-10-01
▶