CVE-2024-0053

What it actually does

The getCustomPrinterIcon method in PrintManagerService.java permits a local caller to retrieve image resources belonging to other users because the service does not properly validate the requesting context or enforce per-user isolation.

Why it matters to the business

Local applications can silently read private user images stored on the device, resulting in exposure of sensitive personal or corporate data without any user interaction or elevated privileges.

How an attack unfolds

A malicious application already present on the device invokes the vulnerable getCustomPrinterIcon entry point; the service incorrectly resolves and returns image data from another user's profile; the attacker then reads and exfiltrates the retrieved images.

How to fix it

Apply the vendor security update that corrects the confused-deputy check inside PrintManagerService.java; where updates are unavailable, restrict installation of untrusted applications and review device policies that limit local data access.

How to confirm the fix worked

Confirm the installed system image contains the corrected PrintManagerService.java implementation; exercise the service from an unprivileged context and verify that cross-user image retrieval is rejected.

Typical attack path

1. Deploy a malicious application on the target device
2. Invoke getCustomPrinterIcon through the PrintManagerService binder interface
3. Receive image content belonging to other users due to missing caller validation
4. Exfiltrate the disclosed images over the network or store them locally

How to detect it

Review system logs for repeated or anomalous calls to getCustomPrinterIcon from non-system packages; inspect for unexpected file reads of printer-icon resources outside the calling application's own data directories.

• getCustomPrinterIcon
• PrintManagerService

What your security team should do

• Prioritize deployment of the OS security patch addressing this local disclosure issue
• Enforce application allow-listing to reduce the attack surface for local service abuse
• Monitor device logs for unexpected invocations of PrintManagerService methods