cbcvebase.
CVE-2017-13208
published 2018-01-12

CVE-2017-13208: In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to…

PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
8.53%
94.5th percentile
In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67474440.

Affected

17 ranges
VendorProductVersion rangeFixed in
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability exists in receive_packet() function within libnetutils/packet.c — monitor for anomalous DHCP response handling in Android DHCP client processes ↗
  • →Exploitation vector is a malicious DHCP response — network-level detection should focus on oversized or malformed DHCP response packets (BOOTP/DHCP, UDP port 68) targeting Android clients ↗
  • →No user interaction required and no additional privileges needed — exploitation can occur silently when an Android device connects to a network and receives a DHCP response; monitor for unexpected privileged process crashes or memory corruption signals on affected Android versions (5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1) ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.