PT-2024-16235 · Google · Car App Android Jetpack Library

Khanh Pham + 1 · Published 2024-11-20 · Updated 2025-07-29 · CVE-2024-10382

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Car App Android Jetpack Library versions prior to 1.7.0-beta02

Description The issue is related to a code execution vulnerability in the Car App Android Jetpack Library. Specifically, the CarAppService uses deserialization logic that allows the construction of arbitrary Java classes, which can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on the victim's device to attack any application that uses the vulnerable library.

Recommendations For versions prior to 1.7.0-beta02, upgrade the library past version 1.7.0-beta02 to resolve the issue. As a temporary workaround, consider restricting the use of the CarAppService until a patch is available. Avoid using the vulnerable library in applications until the issue is resolved.

Fix

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

CVE-2024-10382

Affected Products

Car App Android Jetpack Library

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-10382 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10382 · Vendor Advisory
• https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03 · Note
• https://twitter.com/CVEnew/status/1859223843799474653 · Twitter Post
• https://twitter.com/calif_io/status/1877604212156342591 · Twitter Post
• https://t.me/cveNotify/130136 · Telegram Post
• https://t.me/cvenotify/102559 · Telegram Post
• https://t.me/cvenotify/102249 · Telegram Post
• https://t.me/cvedetector/11582 · Telegram Post
• https://twitter.com/oktsec/status/1859214523091021944 · Twitter Post