Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-34740. PoCs published by michalbednarski.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-34740, leveraging a vulnerability in Android's Binary XML format to achieve privilege escalation by manipulating the `install_sessions.xml` file. The exploit involves injecting a malicious byte array to alter the installation path, allowing arbitrary code execution within the `system_server` context.
Description
In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Exploits (1)
This repository contains a functional exploit for CVE-2024-34740, leveraging a vulnerability in Android's Binary XML format to achieve privilege escalation by manipulating the `install_sessions.xml` file. The exploit involves injecting a malicious byte array to alter the installation path, allowing arbitrary code execution within the `system_server` context.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H