CVE-2018-9527: Critical severity Google Android vulnerability

Published Nov 5, 2018

Updated

In vorbisbookdecodevset of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112159345

Affected Software

7 affected components

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2018-11-01

Event History

Nov 5, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Nov 14, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

Which Android devices are exposed and what does an attacker need?

Devices running Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, or 9 are listed as affected. Exploitation requires user interaction, but does not require the attacker to have additional execution privileges.

What is the impact and is a fix available?

The flaw is an out-of-bounds write in vorbis_book_decodev_set in codebook.c, which can lead to remote code execution with high impact to confidentiality, integrity, and availability. A patch is available.