Wiz
Vulnerability DatabaseCVE-2024-0047

CVE-2024-0047: 
NixOS vulnerability analysis and mitigation

Overview

In the Android Framework, specifically within the writeUserLP function of UserManagerService.java, a vulnerability (CVE-2024-0047) was identified where device policies are incorrectly serialized due to a logic error in the code. This vulnerability affects Android devices and was disclosed in March 2024 (NVD Dashboard).

Technical details

The vulnerability stems from a storage format issue related to user versions in Android. When upgrading from userVersion 9 (Android 13) to userVersion 10, local user restrictions were incorrectly being read as base restrictions, causing improper serialization of device policies (Android Git).

Impact

The vulnerability could potentially affect device policy management and user restrictions handling on Android devices, particularly during version upgrades from Android 13 (CIS Advisory).

Mitigation and workarounds

A fix has been implemented that properly reads the old version and converts it to the new storage format. The solution includes proper storage of device policy user restrictions and has been tested with specific test cases including 'UserRestrictionsTest' and 'UserManagerServiceUserInfoTest' (Android Git).

Additional resources

Source: This report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-78662HIGH7.5
  • Docker logoDocker
  • telegraf-1.38
NoYesSep 02, 2026
CVE-2026-56855HIGH7.5
  • Docker logoDocker
  • flux-notification-controller
NoYesSep 02, 2026
CVE-2026-84642HIGH7.5
  • NixOS logoNixOS
  • cpe:2.3:a:mozilla:thunderbird
NoYesSep 01, 2026
CVE-2026-84641HIGH7.5
  • NixOS logoNixOS
  • thunderbird
NoYesSep 01, 2026
CVE-2026-84640HIGH7.5
  • NixOS logoNixOS
  • cpe:2.3:a:mozilla:thunderbird
NoYesSep 01, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo