CVE-2011-1823: Android OS Privilege Escalation Vulnerability
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PFNETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
Other sources
The vold volume manager daemon in Android kernel trusts messages from a PFNETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1823?
CVE-2011-1823 is classified as a critical vulnerability because it allows local users to execute arbitrary code and gain root privileges.
How do I fix CVE-2011-1823?
To fix CVE-2011-1823, upgrade to Android version 2.3.4 or later, or a newer version that is not affected.
Which versions of Android are affected by CVE-2011-1823?
CVE-2011-1823 affects Android versions 2.1 through 3.0, specifically all versions before 2.3.4.
What type of attack can be executed via CVE-2011-1823?
CVE-2011-1823 allows a local user to perform a local privilege escalation attack by manipulating the vold volume manager.
Who can exploit CVE-2011-1823?
CVE-2011-1823 can be exploited by any local user with the capability to send messages to the PF_NETLINK socket.