CVE-2024-48336
Published: 04 November 2024
Summary
CVE-2024-48336 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability. Its CVSS base score is 8.4 (High).
Operationally, ranked in the top 4.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an improper control of generation of code (CWE-829) in the install() function of ProviderInstaller.java within the Magisk App prior to canary version 27007. The function loads a GMS app package without verification, enabling a local attacker to supply a malicious package that the Magisk process will execute.
A local untrusted application running with no special privileges can exploit the flaw without user interaction. Successful exploitation allows the attacker to execute arbitrary code inside the Magisk process and thereby obtain root privileges on the device.
The referenced commit c2eb6039579b8a2fb1e11a753cea7662c07bec02 in the Magisk repository addresses the issue by adding verification of the GMS package before loading. A public proof-of-concept demonstrating the attack is available at the canyie/MagiskEoP repository.
The EPSS score has remained flat at 0.1659 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42994
Vulnerability details
The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app…
more
and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.