CVE-2011-1823highunder attackCWE-190

CVE-2011-1823

Published · Updated

Follow this CVE+ Monitor Android

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 41%
from disclosure to weapon
Published on NVDJun 9
CISA KEV+4109d
Action required by CISAfederal deadline: 2022-09-29

Apply updates per vendor instructions.

In short

The Android volume manager trusts untrusted network messages without proper validation, allowing local attackers to execute code as root by sending a specially crafted message that crashes the system in a controlled way.

Technical detail

A signed integer overflow vulnerability in DirectVolume::handlePartitionAdded fails to validate negative index values from PF_NETLINK messages, enabling local privilege escalation through heap memory corruption. Exploitation requires local access to send crafted netlink packets, resulting in arbitrary code execution with root privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a