CVE-2018-9540: High severity Google Android vulnerability

Published Nov 5, 2018

Updated

In avrcctrlparsvendorrsp of avrcparsct.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-111450417

Affected Software

7 affected components

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2018-11-01

Event History

Nov 5, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Nov 14, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker able to reach the affected device over Bluetooth can exploit it remotely. No prior privileges or user interaction are required.

What is the impact of successful exploitation?

Successful exploitation can disclose information from the affected Android device through an out-of-bounds read. The provided CVSS vector indicates high confidentiality impact, with no integrity or availability impact.

Which Android releases are affected?

The affected releases listed are Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.

What should teams do to remediate this issue?

Apply the available patch for Android ID A-111450417. The referenced Android security bulletin is dated 2018-11-01.