CVE-2018-9586: Race Condition
In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, it is possible that package verification is turned off and remains off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116754444.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running the affected Android releases are exposed: Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9. Exploitation is local, so an attacker needs access to execute locally on the device.
What level of access and interaction does exploitation require?
The CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction. Successful exploitation can result in high impact to confidentiality, integrity, and availability through local privilege escalation.
What is the security impact of the race condition?
The race condition can cause package verification to be disabled and remain disabled. This can enable local escalation of privilege without requiring additional execution privileges.
Is a fix available?
Yes. A patch is available, and the issue is referenced in the Android security bulletin dated 2019-01-01.