Executive Summary

This vulnerability exists in the PackageInstaller.Session#transfer method within the Android PackageInstaller component. It is caused by a logic error that can lead to a memory exhaustion attack.

An attacker can exploit this flaw locally without needing any special privileges or user interaction, potentially causing the system to run out of memory.

This results in a denial of service condition on the affected device.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a local denial of service (DoS) on the affected Android device.

Because the attack can be performed without any privileges or user interaction, it could be triggered by a local attacker or malicious app to disrupt normal device operation by exhausting memory resources.

No additional execution privileges are needed, so the attacker does not gain control beyond causing the device or service to become unresponsive.

Useful 0 Not Useful 0