CVE-2018-9538: High severity Google Android vulnerability
In V4L2SliceVideoDecodeAccelerator::Dequeue of v4l2slicevideodecodeaccelerator.cc, there is a possible out of bounds read of a function pointer due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.1 Android-9. Android ID: A-112181526.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Devices running Android 8.1 or Android 9 are identified as affected. Exploitation requires local access and a low-privileged attacker context.
Does exploitation require user interaction or additional privileges?
No user interaction is required. The vulnerability can be used for local privilege escalation without needing additional execution privileges beyond the attacker’s existing low privileges.
What should teams do if they identify an affected device?
Apply the available patch for Android ID A-112181526. The issue is addressed in the Android security bulletin published on 2018-12-01.