CVE-2024-29779: VZW ALL Inmarket Pixel - RemoveShowcase Demo App from Preload
Summary
CVE-2024-29779: there is a possible escalation of privilege due to an unusual root cause. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-09-05. Fixed in Pixel-family specific:2024-09-05. How to fix ↓
Also tracked for
- platform/system/keymint · Android
The same CVE-2024-29779 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The VZW ALL Inmarket Pixel package is an Android ecosystem-specific package that is preloaded on Pixel-family devices. It includes various applications and features designed for Verizon Wireless customers. One of the included apps is the Showcase demo app, which allows users to explore and experience the device's capabilities. However, this app contains a vulnerability that could potentially lead to an escalation of privilege.
Vulnerability Detail
The vulnerability in the Showcase demo app arises from an unusual root cause. It enables a local escalation of privilege without requiring any additional execution privileges or user interaction. This means that an attacker with access to the device could exploit this vulnerability to gain elevated privileges and perform unauthorized actions. The severity of this vulnerability is classified as high.
How To Fix
Minimum fixed version
Pixel-family specific:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to follow the recommended fix and update their devices to the latest version of the VZW ALL Inmarket Pixel package.
Conclusion
The VZW ALL Inmarket Pixel package, specifically the Showcase demo app, contains a vulnerability that allows for a local escalation of privilege. Users are advised to update their devices to the latest version of the package to mitigate this vulnerability.
See every vulnerability recorded for :unknown: →
FAQ
The vulnerability allows for a local escalation of privilege, potentially enabling an attacker to gain elevated privileges on the device.
No, user interaction is not needed for exploitation of this vulnerability.
This vulnerability affects Pixel-family devices with the VZW ALL Inmarket Pixel package installed.
Yes, a fix for this vulnerability was released on September 5, 2024.
The severity of this vulnerability is classified as high.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
