Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-09-29. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🚨 CVE-2011-1823 | CVSS 7.8 HIGH Android 2.x-3.0 vold daemon flaw allows local privilege escalation to root via crafted netlink messages. Exploited by Gingerbreak. Affected: Android 2.x <2.3.4, 3.0 #CVE #Vulnerability #PatchNow https://t.co/bb3wKp6fjS
Post summary
CVE‑2011‑1823 is a local privilege escalation flaw in Android 2.x–3.0’s vold daemon that has been actively exploited in the wild via crafted netlink messages.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | android | - | - | - | |
| OS | android | 3.0 | - | - |