{"id":"ASB-A-341256043","details":"In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-341256043","CVE-2024-43081"],"modified":"2026-06-03T15:06:08.149995907Z","published":"2024-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/31c098c4271ad4fdfb3809e05017ead8d9f6580f"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2024-11-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-341256043-19fc65f9","digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","70078933855901175012213158357255615818","130782364824674563949830595169623224801","97768317995976597419647832143432107752","172462288539287315524255640510087042382","317262461759818309976398071849066620926","248144891049726392850816756954403720649","312468334464122519273056096798021863641"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/04534c3920f01680cc6f50f57737a25f8f893bb1","signature_type":"Line","deprecated":false,"signature_version":"v1","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}},{"signature_version":"v1","digest":{"length":4209,"function_hash":"123079867802361225203984530978881524921"},"source":"https://android.googlesource.com/platform/frameworks/base/+/04534c3920f01680cc6f50f57737a25f8f893bb1","signature_type":"Function","id":"ASB-A-341256043-5f3b4164","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java","function":"installExistingPackageAsUser"}}],"spl":"2024-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/04534c3920f01680cc6f50f57737a25f8f893bb1"],"severity":"High","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-11-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","296894583660661426208559435853166139488","134059891320470609010110375269386693265","87827947278605910285015675450360337511","297779046294581971934514079856474345082","91372568986300504860656369904178241421","62528426924789878548411396549682360680","279262341454628670883687670865949774028"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","signature_type":"Line","id":"ASB-A-341256043-092e696f","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}},{"id":"ASB-A-341256043-85e20080","digest":{"length":3176,"function_hash":"169378628322195178800036635740531678488"},"source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"installExistingPackageAsUser"}}],"spl":"2024-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6"],"severity":"High","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-11-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","296894583660661426208559435853166139488","134059891320470609010110375269386693265","87827947278605910285015675450360337511","297779046294581971934514079856474345082","91372568986300504860656369904178241421","62528426924789878548411396549682360680","279262341454628670883687670865949774028"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","signature_type":"Line","id":"ASB-A-341256043-12a029f6","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}},{"signature_version":"v1","digest":{"length":3176,"function_hash":"169378628322195178800036635740531678488"},"source":"https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6","signature_type":"Function","id":"ASB-A-341256043-681a1021","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"installExistingPackageAsUser"}}],"spl":"2024-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/b0bed46691db3fa0b9a109d236cb9cd85f4042e6"],"severity":"High","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-11-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-341256043-8cb1b649","digest":{"length":3471,"function_hash":"161096543094585787186067188891530604553"},"source":"https://android.googlesource.com/platform/frameworks/base/+/691d163e52bc64a47cabe825a7e1ce05b8666b90","signature_type":"Function","signature_version":"v1","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java","function":"installExistingPackageAsUser"}},{"id":"ASB-A-341256043-afa106b9","digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","70078933855901175012213158357255615818","130782364824674563949830595169623224801","97768317995976597419647832143432107752","67309133150296479806491525255240177062","40025720798354206229700566048601506411","99074010020045898353170880770390954342","236805338225694266776590835676271477600"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/691d163e52bc64a47cabe825a7e1ce05b8666b90","signature_type":"Line","deprecated":false,"signature_version":"v1","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}}],"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/691d163e52bc64a47cabe825a7e1ce05b8666b90"],"severity":"High","spl":"2024-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-341256043-4464e24f","digest":{"threshold":0.9,"line_hashes":["247072308262172872979524978937761345608","70078933855901175012213158357255615818","130782364824674563949830595169623224801","97768317995976597419647832143432107752","172462288539287315524255640510087042382","317262461759818309976398071849066620926","248144891049726392850816756954403720649","312468334464122519273056096798021863641"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/1e0d36fa4381c44e6941c6a2f505ceba666b7d5c","signature_type":"Line","deprecated":false,"signature_version":"v1","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}},{"id":"ASB-A-341256043-f2920905","source":"https://android.googlesource.com/platform/frameworks/base/+/1e0d36fa4381c44e6941c6a2f505ceba666b7d5c","digest":{"length":3906,"function_hash":"59012736023083714650321919848491470861"},"signature_type":"Function","signature_version":"v1","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java","function":"installExistingPackageAsUser"}}],"spl":"2024-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/1e0d36fa4381c44e6941c6a2f505ceba666b7d5c"],"severity":"High","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-341256043.json"}}],"schema_version":"1.7.5"}