PT-2018-19004 · Google · Android Kernel

Johannes Segitz · Publicado 2018-07-14 · Atualizado 2019-08-19 · CVE-2018-9422

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a use-after-free in the get futex key function of futex.c due to improper locking. This could lead to local escalation of privilege with no additional privileges needed. User interaction is not required for exploitation.

Recommendations For Android kernel, apply the fix for the use-after-free in the get futex key function to prevent local escalation of privilege.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2018-9422

DLA-1422-1

DLA-1422-2

Produtos afetados

Android Kernel

Referências · 14

• https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html · Nota
• https://source.android.com/security/bulletin/2018-07-01 · Aviso do Fabricante
• https://bugzilla.suse.com/show_bug.cgi?id=1102001&_ga=2.244341506.661832603.1561012452-1774095668.1553066022 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-9422 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1422-1 · Aviso do Fabricante
• https://git.kernel.org/linus/65d8fc777f6dcfee12785c057a6b57f679641c90 · Nota
• https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html · Nota
• https://osv.dev/vulnerability/CVE-2018-9422 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-9422 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9422 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1422-2 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-9422 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-9422 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-9422 · Aviso do Fabricante