VULNERABILITY INTELLIGENCE

CVE-2011-1823

CVSS score7.8 HIGH
EPSS probability41.37%
CISA KEVKnown exploited vulnerability
Published2011-06-09
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Android OS Privilege Escalation Vulnerability

Vendor / product: Android / Android OS

Description

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Weakness classification

  • CWE-190: Integer Overflow or Wraparound

Primary references