CVE-2024-43081 AI-generated analysis
platform/frameworks/base, PackageManagerService (services/core/java/com/android/server/pm/InstallPackageHelper.java)
InstallPackageHelper.installExistingPackageAsUser now rejects --install-existing requests that carry INSTALL_INSTANT_APP when the target package is a device admin for the user or a protected package, returning INSTALL_FAILED_INVALID_URI as it already did for system and updated-system apps.
Root cause
In InstallPackageHelper.installExistingPackageAsUser, when the caller set INSTALL_INSTANT_APP, the only guard was `instantApp && (pkgSetting.isSystem() || pkgSetting.isUpdatedSystemApp())`. An already-installed package that is a device admin for the target user, or one reported protected by mPm.mProtectedPackages.isPackageStateProtected, could therefore be re-installed for a user as an instant app; the commit message states such packages should be prevented from being reinstalled with --install-existing as instant.
How the fix works
- services/core/java/com/android/server/pm/InstallPackageHelper.java:installExistingPackageAsUser - before taking mPm.mLock, computes `isPackageDeviceAdmin = mPm.isPackageDeviceAdmin(packageName, userId)` and `isProtectedPackage = mPm.mProtectedPackages != null && mPm.mProtectedPackages.isPackageStateProtected(userId, packageName)`.
- Same function - extends the existing instant-app rejection to `instantApp && (pkgSetting.isSystem() || pkgSetting.isUpdatedSystemApp() || isPackageDeviceAdmin || isProtectedPackage)`, returning Pair.create(PackageManager.INSTALL_FAILED_INVALID_URI, intentSender) for the new cases. Single commit, one file, 5 insertions / 1 deletion.
Completeness
- Covers only the INSTALL_INSTANT_APP branch of installExistingPackageAsUser; a --install-existing request without the instant flag for a device admin or protected package is unchanged by this commit.
- The device-admin and protected checks are evaluated for the single target userId passed in and are computed outside the synchronized(mPm.mLock) block; the subsequent pkgSetting lookup happens under the lock.
- The protected-package check is skipped when mPm.mProtectedPackages is null (null guard), in which case only the device-admin check adds protection.
- Whether other install paths that accept INSTALL_INSTANT_APP in InstallPackageHelper enforce equivalent checks is not shown in the material.
Behavior changes
- installExistingPackageAsUser returns INSTALL_FAILED_INVALID_URI (instead of proceeding) when INSTALL_INSTANT_APP is requested for a package that is a device admin for the target user or is a protected package.
- Two additional lookups (mPm.isPackageDeviceAdmin, mProtectedPackages.isPackageStateProtected) are performed on every installExistingPackageAsUser call that reaches that point, regardless of the instant flag.
Per major
- Android 14: same fix: commit 31c098c4271a landed in android-security-14.0.0_r14; patched region present (7/8 lines) at android-security-14.0.0_r29.
- Android 15: not listed by the bulletin; 7/8 lines of the patched region present at android-security-15.0.0_r17 (differing line not shown).
- Android 16: not listed by the bulletin; 7/8 lines of the patched region present at android-security-16.0.0_r8.
- Android 17: not listed by the bulletin; 7/8 lines of the patched region present at android-security-17.0.0_r1.
Unknowns
- The material does not show how re-installing a device admin or protected package as instant was abused or what concrete privilege was gained; only the bulletin rating (High, EoP) is known.
- The 7/8-line match in the later security tags is not explained; the one differing line is not shown.
- Whether sibling install paths accepting INSTALL_INSTANT_APP have equivalent device-admin/protected checks is not shown.
- Where installExistingPackageAsUser lives on the other affected branches (12, 12L, 13) and how the fix was applied there is not shown.