CVE-2011-1823

Android OS Privilege Escalation

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 41.4%

Published9 Jun 2011
Added to CISA KEV8 Sept 2022
Remediation due29 Sept 2022

Description

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Google Android≥ 2.0 < 2.3.4 · 3.0

Remediation

Fixed in

Google Android≥ 2.3.4

References

http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/Broken Link
http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a5d6Broken Link
http://android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd2934836fBroken Link
http://android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be0430849837d6fdc5352eBroken Link
http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.htmlExploitIssue Tracking
http://forum.xda-developers.com/showthread.php?t=1044765ExploitIssue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/67977Third Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1823US Government Resource
http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/Press/Media Coverage
http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/Exploit

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2011-1823 being actively exploited?

Yes. CVE-2011-1823 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 8 Sept 2022.

How severe is CVE-2011-1823?

CVE-2011-1823 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 41.4% probability of exploitation.

Which products are affected by CVE-2011-1823?

Affected products include Google Android.

How do I fix CVE-2011-1823?

Upgrade affected software to a fixed version, for example Google Android 2.3.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2011-1823 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.