# CVE-2024-0044

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

- Page: https://www.vulneraibility.com/cve/CVE-2024-0044
- CVSS: 6.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 1.46% (percentile 73.9)
- Unvetted proof-of-concept code on GitHub: 15 GitHub proofs of concept (first 2024-06-18)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2024-06-21)
- Weakness: CWE-75
- Published: 2024-03-11

## Affected versions

- Google Android: affected 15; 14; 13; 12L; 12

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://android.googlesource.com/platform/frameworks/base/+/954b2874b85b6cd0d6bb12cd677cdf22e5dbd77b
- [other] https://android.googlesource.com/platform/frameworks/base/+/836750619a8bce0bf78fe0549f9990e294671563
- [other] https://source.android.com/security/bulletin/2024-10-01
- [other] https://android.googlesource.com/platform/frameworks/base/+/65bd134b0a82c51a143b89821d5cdd00ddc31792
- [other] https://source.android.com/security/bulletin/2024-03-01
- [other] https://rtx.meta.security/exploitation/2024/03/04/Android-run-as-forgery.html
- [other] https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-m7fh-f3w4-r6v2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.