CVE-2024-0046
📋 TL;DR
This vulnerability allows local privilege escalation on Android devices by bypassing carrier restrictions during package installation. Attackers can exploit a logic error in the installExistingPackageAsUser function to gain elevated privileges without user interaction. All Android devices running vulnerable versions are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of malicious apps with system-level privileges, data theft, and persistent backdoor installation.
Likely Case
Local attacker gains elevated privileges to install unauthorized applications, modify system settings, or access restricted data.
If Mitigated
Limited impact with proper app sandboxing and security controls in place, though privilege escalation still possible.
🎯 Exploit Status
Exploitation requires local access but no user interaction or special permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: March 2024 Android Security Patch
Vendor Advisory: https://source.android.com/security/bulletin/2024-03-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install March 2024 Android security patch. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable multiple user profiles
androidRemove additional user profiles to eliminate attack vector
Settings > System > Multiple users > Remove additional users
🧯 If You Can't Patch
- Restrict physical access to devices and implement strong device management policies
- Monitor for suspicious package installation attempts and privilege escalation events
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version > Security patch levelCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows March 2024 or later📡 Detection & Monitoring
Log Indicators:
- Package installation attempts with carrier restriction bypass
- Unexpected privilege escalation events in system logs
Network Indicators:
- None (local exploit only)
SIEM Query:
source="android_system" AND (event="package_install" AND restriction_bypass=true) OR (event="privilege_escalation")🔗 References
- https://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c
- https://source.android.com/security/bulletin/2024-03-01
- https://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c
- https://source.android.com/security/bulletin/2024-03-01
