CVE-2024-43769: Android Frameworks Base Package Device Admin Uninstallation Logic Error
Summary
CVE-2024-43769: In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. Affects platform/frameworks/base across 3 version ranges.
>= 13:0, < 13:2024-12-01
>= 14:0, < 14:2024-12-01
>= 15-next:0, < 15-next:2024-12-01
Fixed in 15-next:2024-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities that support application development and system operations. It includes various services, including the PackageManagerService, which manages the installation, uninstallation, and updating of applications. This package is critical for maintaining the integrity and security of the Android ecosystem. However, a recent vulnerability has been identified that affects the uninstallation process of CloudDpc, a device policy controller, due to a logic error in the code.
Vulnerability Detail
The vulnerability arises in the isPackageDeviceAdmin method of PackageManagerService.java, where a logic error can prevent the uninstallation of CloudDpc. This issue allows for a local escalation of privilege without requiring additional execution privileges or user interaction. If exploited, it could lead to unauthorized access or control over device administration features, posing significant security risks.
How To Fix
Minimum fixed version
15-next:2024-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the available patches as soon as possible to mitigate the risk.
Conclusion
The CVE-2024-43769 vulnerability in the Android Frameworks Base package poses a serious risk due to a logic error that prevents the uninstallation of CloudDpc. Immediate action is required to update the affected packages to the patched versions to ensure device security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-43769 is a vulnerability in the Android Frameworks Base package that affects the uninstallation of CloudDpc due to a logic error in the code.
The vulnerability can lead to local escalation of privilege, allowing unauthorized access to device administration features without user interaction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Update the Android Frameworks Base package to the patched versions available for 15-next, 14, and 13 as detailed in the 'how to fix' section.
No, user interaction is not needed for exploitation, making it a significant security concern.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
