CVE-2018-9547: Input Validation

Published Dec 3, 2018

Updated

In unflatten of GraphicBuffer.cpp, there is a possible bad fd close due to improper input validation. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.1 Android-9. Android ID: A-114223584.

Affected Software

3 affected components

Google Android=8.1

Google Android=9.0

Google Android

Event History

Dec 3, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Dec 6, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A local attacker with low privileges can exploit it. The CVSS vector indicates no user interaction is required and no additional execution privileges are needed.

Which Android versions are affected?

The affected versions listed are Android 8.1 and Android 9.

What is the potential impact?

Successful exploitation could allow local escalation of privilege in the system server, with high impact to confidentiality, integrity, and availability.

Is a fix available?

Yes. A patch is available; the supplied references include the Android security bulletin dated 2018-12-01 and the associated source change.