CVE-2018-9439

In __unregister_prot_hook and packet_release of af_packet.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://source.android.com/security/bulletin/pixel/2018-08-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

History

19 Dec 2024, 16:34

Type	Values Removed	Values Added
First Time		Google android Google
References	~~() https://source.android.com/security/bulletin/pixel/2018-08-01 -~~	() https://source.android.com/security/bulletin/pixel/2018-08-01 - Vendor Advisory
CPE		cpe:2.3:o:google:android:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 6.7

05 Dec 2024, 16:15

Type	Values Removed	Values Added
CWE		CWE-416
Summary		(es) En __unregister_prot_hook y packet_release de af_packet.c, existe un posible use-after-free debido a un bloqueo inadecuado. Esto podría provocar una escalada local de privilegios en el kernel, con permisos de ejecución de System necesarios. No se necesita la interacción del usuario para la explotación.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

Information

Published : 2024-12-05 00:15

Updated : 2024-12-19 16:34

NVD link : CVE-2018-9439

Mitre link : CVE-2018-9439

CVE.ORG link : CVE-2018-9439

JSON object : View

Products Affected

google

android

CWE

CWE-416

Use After Free

{"id": "CVE-2018-9439", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-12-05T00:15:18.337", "references": [{"url": "https://source.android.com/security/bulletin/pixel/2018-08-01", "tags": ["Vendor Advisory"], "source": "security@android.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In __unregister_prot_hook and packet_release of af_packet.c, there is a\n possible use-after-free due to improper locking. This could lead to local\n escalation of privilege in the kernel with System execution privileges\n needed. User interaction is not needed for exploitation."}, {"lang": "es", "value": "En __unregister_prot_hook y packet_release de af_packet.c, existe un posible use-after-free debido a un bloqueo inadecuado. Esto podr\u00eda provocar una escalada local de privilegios en el kernel, con permisos de ejecuci\u00f3n de System necesarios. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."}], "lastModified": "2024-12-19T16:34:09.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}