Google Android Display memory corruption

Summaryinfo

A vulnerability, which was classified as critical, has been found in Google Android. The impacted element is an unknown function of the component Display. Performing a manipulation results in memory corruption. This vulnerability was named CVE-2018-5908. The attack needs to be approached locally. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability classified as critical has been found in Google Android (Smartphone Operating System) (affected version unknown). This affects an unknown functionality of the component Display. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overflow in display function due to lack of buffer length validation before copying.

The bug was discovered 11/05/2018. The weakness was presented 11/27/2018 (Website). The advisory is shared at source.codeaurora.org. This vulnerability is uniquely identified as CVE-2018-5908 since 01/19/2018. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/11/2023). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 22 days. During that time the estimated underground price was around $5k-$25k.

Applying a patch is able to eliminate this problem.

See VDB-127236, VDB-127235, VDB-127234 and VDB-127232 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion