High · 7.8 CVE-2024-23710 EUVD-2024-21171GHSA-2f36-cx3x-62vx

In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privile…

Published May 7, 2024 · Updated Mar 26, 2025 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	14, 13	—

Advisories 2

WID-SEC-2024-0758 Google Android Patchday April 2024: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 1, 2024
WID-SEC-2024-0757 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 1, 2024

References

https://android.googlesource.com/platform/frameworks/base/+/c7c1193ca7554fc3182ca9ab0f711bd118bdeef2
https://source.android.com/security/bulletin/2024-04-01

EUVD	v3.1	7.8
CISA-ADP	v3.1	7.8