CVE-2024-0044:
NixOS vulnerability analysis and mitigation

Overview

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app vulnerability due to improper input validation in Android 12 and 13. The vulnerability (CVE-2024-0044) allows an attacker with ADB access to bypass the debuggability check and run code in the context of any non-system-UID app, leading to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (Meta Red Team X, Android Bulletin).

Technical details

The vulnerability stems from insufficient validation of installer package names in PackageInstallerService.java. When setting an installer package name via pm install's -i flag, special characters including newlines are not properly sanitized. While these characters are escaped in packages.xml, they remain unescaped in packages.list, allowing injection of fake entries. The run-as tool uses packages.list to verify app debuggability and other properties, making it possible to bypass security checks by injecting crafted entries (Meta Red Team X).

Impact

An attacker can read and write private data and invoke system APIs as if they were most apps on the system, including many privileged apps (but not ones running as system user). On devices with Google Mobile Services (GMS), the attacker can achieve persistent code execution by modifying cached ODEX/VDEX files in GMS's data directory, which also affects apps using Google APIs (Meta Red Team X).

Mitigation and workarounds

The vulnerability was fixed in Android 14 by ensuring PackageInstallerService validates that installer package names reference installed packages. Google released patches in the March 2024 Android Security Bulletin, and device manufacturers received advance notice to prepare updates. Users should update to the latest available security patches (Android Bulletin).

Community reactions

The vulnerability was discovered and reported by Meta Red Team X to Google on October 24, 2023. Google rated it as High severity and developed fixes that were included in the March 2024 security updates. Meta agreed to coordinate disclosure with Google's patch release timeline (Meta Red Team X).