PT-2011-2906 · Google · Android

Publicado 2011-04-21 · Atualizado 2011-04-23 · CVE-2011-1149

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 2.3

Description The issue allows local applications to bypass the application sandbox and gain privileges due to improper access restriction to the system property space. This is related to the use of Android shared memory (ashmem) and ASHMEM SET PROT MASK.

Recommendations For Android versions prior to 2.3, consider restricting access to the system property space to prevent local applications from bypassing the application sandbox and gaining privileges. As a temporary workaround, consider disabling the use of ashmem and ASHMEM SET PROT MASK until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-1149

Produtos afetados

Android

Referências · 10

• 🔥 http://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Rooting_the_G2 · Exploit
• https://github.com/tmzt/g2root-kmod/tree/scotty2/scotty2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-1149 · Nota de Segurança
• http://c-skills.blogspot.com/2011/01/adb-trickery-again.html · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-1149 · Aviso do Fabricante
• http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=25b15be9120bcdaa0aba622c67ad2c835d9e91ca · Nota
• https://cve.org/CVERecord?id=CVE-2011-1149 · Nota de Segurança
• http://android.git.kernel.org/?p=kernel/common.git%3Ba=commit%3Bh=c98a285075f26e2b17a5baa2cb3eb6356a75597e · Nota
• https://ubuntu.com/security/CVE-2011-1149 · Aviso do Fabricante
• http://groups.google.com/group/android-security-discuss/browse_thread/thread/15f97658c88d6827/e86db04652651971?show_docid=e86db04652651971 · Nota