CVE-2018-9475: High severity Google Android vulnerability

Published Sep 4, 2018

Updated

In HeadsetInterface::ClccResponse of btifhf.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote escalation of privilege via Bluetooth, if the recipient has enabled SIP calls with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

7 affected components

Google Android

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android=9.0

Remediation

Patch Available

https://source.android.com/security/bulletin/2018-09-01

Event History

Sep 4, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Nov 20, 2024

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-9475?

CVE-2018-9475 is considered a high severity vulnerability due to its potential for remote escalation of privilege via Bluetooth.

How do I fix CVE-2018-9475?

To remediate CVE-2018-9475, update affected Android devices to the latest security patch provided by Google.

Which versions of Android are affected by CVE-2018-9475?

CVE-2018-9475 affects Android versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.0.

What type of attack does CVE-2018-9475 enable?

CVE-2018-9475 enables remote escalation of privilege through Bluetooth when SIP calls are enabled.

Is user interaction required to exploit CVE-2018-9475?

No, user interaction is not required to exploit CVE-2018-9475, making it particularly concerning.