National Cyber Awareness System

Vulnerability Summary for CVE-2011-1823

Overview

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://android.git.kernel.org/?p=platform/system/netd.git;a=commit;h=79b579c92afc08ab12c0a5788d61f2dd2934836f

Type: Patch Information

Hyperlink:http://android.git.kernel.org/?p=platform/system/netd.git;a=commit;h=79b579c92afc08ab12c0a5788d61f2dd2934836f

External Source: CONFIRM

Name: http://android.git.kernel.org/?p=platform/system/core.git;a=commit;h=b620a0b1c7ae486e979826200e8e441605b0a5d6

Type: Patch Information

Hyperlink:http://android.git.kernel.org/?p=platform/system/core.git;a=commit;h=b620a0b1c7ae486e979826200e8e441605b0a5d6

External Source: MISC

Name: http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/

Hyperlink:http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/

External Source: XF

Name: android-vold-priv-escalation(67977)

Hyperlink:http://xforce.iss.net/xforce/xfdb/67977

External Source: MISC

Name: http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/

Hyperlink:http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/

External Source: MISC

Name: http://forum.xda-developers.com/showthread.php?t=1044765

Hyperlink:http://forum.xda-developers.com/showthread.php?t=1044765

External Source: MISC

Name: http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html

Hyperlink:http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html

External Source: MISC

Name: http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/

Hyperlink:http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/

External Source: CONFIRM

Name: http://android.git.kernel.org/?p=platform/system/vold.git;a=commit;h=c51920c82463b240e2be0430849837d6fdc5352e

Hyperlink:http://android.git.kernel.org/?p=platform/system/vold.git;a=commit;h=c51920c82463b240e2be0430849837d6fdc5352e