PT-2024-4194 · Google · Android

Tchebb

·

Published

2024-03-11

·

Updated

2026-03-16

·

CVE-2024-0044

CVSS v3.1
7.8
VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Android versions 12 and 13
Description The issue is related to improper input validation in the 
createSessionInternal
function of 
PackageInstallerService.java
, which could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation. This could allow an attacker to gain access to the database of any application, including WhatsApp, by exploiting the vulnerability. The estimated number of potentially affected devices is not specified, but the issue is known to affect Android versions 12 and 13.
Recommendations For Android versions 12 and 13, consider disabling the 
createSessionInternal
function until a patch is available. Restrict access to the 
PackageInstallerService
module to minimize the risk of exploitation. Avoid using the 
run-as
command in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77CWE-75CWE-74

Related Identifiers

ASB-A-307532206
BDU:2024-04679
CVE-2024-0044
GHSA-M7FH-F3W4-R6V2

Affected Products

Android