CVEs / CVE-2011-1823
CVE-2011-1823: Android OS Privilege Escalation Vulnerability
- Known exploited in the CISA KEV catalog since 8 Sep 2022
- high 7.8 CVSS 3.1 (NVD)
- EPSS 41.3% chance of exploitation in the next 30 days, higher than 98% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2011-1823
Summary
The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
Description
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 8 Sep 2022 |
|---|---|
| Due date for US federal agencies | 29 Sep 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-190 |
References
- CVE-2011-1823 on NVD
- CVE-2011-1823 in the CISA KEV catalog
- https://android.googlesource.com/platform/system/vold/+/c51920c82463b240e2be0430849837d6fdc5352e (cited by CISA)
- http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a5d6 Broken Link
- http://android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd2934836f Broken Link
- http://android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be0430849837d6fdc5352e Broken Link
- http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/ Broken Link
- http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html Exploit, Issue Tracking
- http://forum.xda-developers.com/showthread.php?t=1044765 Exploit, Issue Tracking
- http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/ Press/Media Coverage
- http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/ Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67977 Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1823 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.