PT-2025-48941 · Android · Android

Publicado 2025-08-28 · Atualizado 2025-12-08 · CVE-2025-48637

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The Android operating system’s pKVM (protected Kernel-based Virtual Machine) virtualization technology contains synchronization errors when adding pages to the memory cache, resulting in a race condition. Exploitation may allow an attacker to gain elevated privileges. Multiple functions within mem protect.c are susceptible to an out-of-bounds write condition caused by an integer overflow, potentially leading to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Time Of Check To Time Of Use

Race Condition

Enumeração de Fraquezas

CWE-190

CWE-367

CWE-362

Identificadores relacionados

BDU:2025-15116

CVE-2025-48637

Produtos afetados

Android

Referências · 8

• https://android.googlesource.com/kernel/common/+/aff2255dbe38dc7c57bac8d3ba9feed989289b20 · Nota
• https://twitter.com/CVEnew/status/1998079558763835673 · Publicação no Twitter
• https://android.googlesource.com/kernel/common/+/4cfc9c2d8815577832cafbfcd7f98025f0da718d · Nota
• https://source.android.com/docs/security/bulletin/2025-12-01 · Nota
• https://source.android.com/security/bulletin/2025-12-01 · Aviso do Fabricante
• https://t.me/CVEtracker/39134 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-48637 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-15116 · Nota de Segurança