Arbitrary Code execution in Car App Android Jetpack Library
Vulnerability Description
There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10382
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Khanh Pham of Calif Hacking Team
- Linh Le of Calif Hacking Team
More from Google
View All →Affected Vendor
