Summaryinfo

A vulnerability categorized as critical has been discovered in Google Android. Affected by this issue is the function easelcomm_hw_build_scatterlist. Executing a manipulation can lead to race condition. The identification of this vulnerability is CVE-2018-9519. The attack can only be executed locally. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Google Android (Smartphone Operating System) (affected version unknown). It has been declared as critical. This vulnerability affects the function easelcomm_hw_build_scatterlist. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In easelcomm_hw_build_scatterlist, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System privileges required. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-69808833.

The bug was discovered 09/04/2018. The weakness was shared 12/07/2018 (Website). The advisory is shared for download at source.android.com. This vulnerability was named CVE-2018-9519 since 04/05/2018. The attack needs to be approached locally. The successful exploitation needs a single authentication. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 94 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

The entries VDB-126519, VDB-127742 and VDB-127743 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion