NVD

Id
8704  
Name
CVE-2011-1823  
Description
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2011-06-09  
Modified Date
2012-04-25  
Seq
2011-1823  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
50227 8704 CVE-2011-1823 http://android.git.kernel.org/?p=platform/system/core.git;a=commit;h=b620a0b1c7ae486e979826200e8e441605b0a5d6  View
50228 8704 CVE-2011-1823 http://android.git.kernel.org/?p=platform/system/netd.git;a=commit;h=79b579c92afc08ab12c0a5788d61f2dd2934836f  View
50229 8704 CVE-2011-1823 http://android.git.kernel.org/?p=platform/system/vold.git;a=commit;h=c51920c82463b240e2be0430849837d6fdc5352e  View
50230 8704 CVE-2011-1823 http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/  View
50231 8704 CVE-2011-1823 http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html  View
50232 8704 CVE-2011-1823 http://forum.xda-developers.com/showthread.php?t=1044765  View
50233 8704 CVE-2011-1823 http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/  View
50234 8704 CVE-2011-1823 android-vold-priv-escalation(67977)  View
50235 8704 CVE-2011-1823 http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31480 JVNDB-2011-001720 Android のボリューム管理デーモンにおける root 権限を取得される脆弱性 Android のボリューム管理デーモンは、PF_NETLINK ソケットからのメッセージであれば信頼してしまうため、任意のコードを実行され、root 権限を取得される脆弱性が存在します。 CVE-2011-1823 49730 CVE-2011-1823 8704 7.2 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001720.html 2011-06-09 2011-06-21 View