CVE Vulnerabilities

CVE-2024-10382

Deserialization of Untrusted Data

Published: Nov 20, 2024 | Modified: Aug 04, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Name Vendor Start Version End Version
Androidx.car.app Google * 1.4.0 (including)
Androidx.car.app Google 1.7.0-alpha01 (including) 1.7.0-alpha01 (including)
Androidx.car.app Google 1.7.0-alpha02 (including) 1.7.0-alpha02 (including)
Androidx.car.app Google 1.7.0-beta01 (including) 1.7.0-beta01 (including)

Potential Mitigations

  • Make fields transient to protect them from deserialization.
  • An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

References