CVE-2024-43081: Android Framework Base Package Local Privilege Escalation Vulnerability
Summary
CVE-2024-43081: In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. Affects platform/frameworks/base across 5 version ranges.
>= 12:0, < 12:2024-11-01
>= 12L:0, < 12L:2024-11-01
>= 13:0, < 13:2024-11-01
>= 14:0, < 14:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework Base package is a core component of the Android operating system, responsible for providing essential services and APIs for application development. It facilitates interactions between applications and the underlying hardware, ensuring smooth functionality and user experience. However, this package is susceptible to vulnerabilities that can compromise device security, particularly in the context of privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2024-43081 arises from a logic error in the 'installExistingPackageAsUser' method of the InstallPackageHelper.java file. This flaw allows a local attacker to bypass carrier restrictions, potentially leading to unauthorized privilege escalation without requiring additional execution privileges. The exploitation of this vulnerability could enable malicious users to gain elevated access to system resources, posing significant security risks.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
The CVE-2024-43081 vulnerability poses a significant risk to the Android Framework Base package, allowing for local privilege escalation without user interaction. It is crucial for developers and users to apply the necessary updates to mitigate potential security threats.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-43081 is a vulnerability in the Android Framework Base package that allows local privilege escalation due to a logic error in the code.
An attacker can exploit this vulnerability by bypassing carrier restrictions, leading to unauthorized access to system resources.
No, user interaction is not needed for exploitation, making it particularly concerning.
You should update the Android Framework Base package to the patched version '15-next:2024-11-01' as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
