CVE-2024-10382 — Arbitrary Code execution in Car App Android Jetpack Library

CVE-2024-10382

Arbitrary Code execution in Car App Android Jetpack Library PUBLISHED

Description (CNA)

There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.

Affected (CNA)

Vendor / product	Versions
Google / Android	affected 1.4.0 before 1.7.0-beta02

CWE

CWE-502

References

https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.