CVE-2024-0046

What it actually does

Logic error in installExistingPackageAsUser allows bypassing carrier restrictions to install packages as another user, resulting in unauthorized local privilege escalation.

Why it matters to the business

Compromised mobile devices may have unauthorized applications installed, increasing risk of data theft, persistent malware, or further attacks without user awareness.

How an attack unfolds

A malicious local application invokes the flawed method to bypass carrier package restrictions and install additional packages as a different user, achieving elevated privileges on the device.

How to fix it

Apply the vendor security update that resolves the logic error in InstallPackageHelper.java; verify device firmware includes the patch for this authorization bypass.

How to confirm the fix worked

Confirm the installed Android build contains the fix for the carrier restriction logic error; review patch release notes and perform regression testing of package installation flows.

Typical attack path

1. Obtain local code execution via a malicious or compromised application
2. Call installExistingPackageAsUser with crafted parameters to trigger the logic flaw
3. Bypass carrier restrictions and install restricted packages as another user
4. Escalate privileges and perform unauthorized actions on the device

How to detect it

Review system logs for unexpected calls to installExistingPackageAsUser or carrier restriction bypass events; examine package manager activity for installations without user interaction.

What your security team should do

• Prioritize deployment of the latest vendor security patches to all affected mobile devices
• Monitor for abnormal package installation attempts in device logs
• Restrict sideloading and carrier-specific app installation where possible