PackageInstallerService DPC App Removal Without DO Consent

Executive Summary

This vulnerability exists in the createSessionInternal method of PackageInstallerService.java. It allows a possible way to remove a Device Policy Controller (DPC) app from a managed device without the Device Owner's (DO) consent due to a desynchronization issue with persistence.

Exploitation requires user interaction and could lead to a local escalation of privilege if a user installs a malicious app. Notably, no additional execution privileges are needed for the malicious app to exploit this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing a local attacker to escalate their privileges on a managed device. Specifically, it could enable the removal of a Device Policy Controller app without proper authorization, potentially compromising device management and security controls.

Since the attacker can install a malicious app without needing additional execution privileges, this could lead to unauthorized actions on the device, undermining the security posture of the managed environment.

Useful 0 Not Useful 0