{"id":"ASB-A-341256043","details":"In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-341256043","CVE-2024-43081"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/31c098c4271ad4fdfb3809e05017ead8d9f6580f"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2024-11-01"}]}],"versions":["15-next"],"ecosystem_specific":{"severity":"High","spl":"2024-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["247072308262172872979524978937761345608","70078933855901175012213158357255615818","130782364824674563949830595169623224801","97768317995976597419647832143432107752","172462288539287315524255640510087042382","317262461759818309976398071849066620926","248144891049726392850816756954403720649","312468334464122519273056096798021863641"],"threshold":0.9},"id":"ASB-A-341256043-19fc65f9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/04534c3920f01680cc6f50f57737a25f8f893bb1","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/04534c3920f01680cc6f50f57737a25f8f893bb1","target":{"function":"installExistingPackageAsUser","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"function_hash":"123079867802361225203984530978881524921","length":4209},"id":"ASB-A-341256043-5f3b4164","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/04534c3920f01680cc6f50f57737a25f8f893bb1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-11-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6"],"severity":"High","spl":"2024-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["247072308262172872979524978937761345608","296894583660661426208559435853166139488","134059891320470609010110375269386693265","87827947278605910285015675450360337511","297779046294581971934514079856474345082","91372568986300504860656369904178241421","62528426924789878548411396549682360680","279262341454628670883687670865949774028"],"threshold":0.9},"id":"ASB-A-341256043-092e696f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"installExistingPackageAsUser"},"deprecated":false,"digest":{"function_hash":"169378628322195178800036635740531678488","length":3176},"id":"ASB-A-341256043-85e20080","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-11-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6"],"severity":"High","spl":"2024-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","296894583660661426208559435853166139488","134059891320470609010110375269386693265","87827947278605910285015675450360337511","297779046294581971934514079856474345082","91372568986300504860656369904178241421","62528426924789878548411396549682360680","279262341454628670883687670865949774028"]},"id":"ASB-A-341256043-12a029f6","signature_type":"Line"},{"id":"ASB-A-341256043-681a1021","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"installExistingPackageAsUser"},"deprecated":false,"digest":{"function_hash":"169378628322195178800036635740531678488","length":3176}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-11-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/691d163e52bc64a47cabe825a7e1ce05b8666b90"],"severity":"High","spl":"2024-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-341256043-8cb1b649","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/691d163e52bc64a47cabe825a7e1ce05b8666b90","target":{"function":"installExistingPackageAsUser","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"length":3471,"function_hash":"161096543094585787186067188891530604553"}},{"digest":{"line_hashes":["247072308262172872979524978937761345608","70078933855901175012213158357255615818","130782364824674563949830595169623224801","97768317995976597419647832143432107752","67309133150296479806491525255240177062","40025720798354206229700566048601506411","99074010020045898353170880770390954342","236805338225694266776590835676271477600"],"threshold":0.9},"id":"ASB-A-341256043-afa106b9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/691d163e52bc64a47cabe825a7e1ce05b8666b90","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2024-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","70078933855901175012213158357255615818","130782364824674563949830595169623224801","97768317995976597419647832143432107752","172462288539287315524255640510087042382","317262461759818309976398071849066620926","248144891049726392850816756954403720649","312468334464122519273056096798021863641"]},"id":"ASB-A-341256043-4464e24f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1e0d36fa4381c44e6941c6a2f505ceba666b7d5c","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false},{"id":"ASB-A-341256043-f2920905","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1e0d36fa4381c44e6941c6a2f505ceba666b7d5c","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java","function":"installExistingPackageAsUser"},"deprecated":false,"digest":{"function_hash":"59012736023083714650321919848491470861","length":3906}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1e0d36fa4381c44e6941c6a2f505ceba666b7d5c"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}}],"schema_version":"1.9.0"}