CVE-2018-9357 — Out-of-bounds Write in INC Android

CWE-787 — Out-of-bounds Write4 documents4 sources

Severity

7.8HIGHNVD

EPSS

0.0%

top 90.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google INC Android Google Android

Timeline

PublishedNov 6

Latest updateMay 14

Description

In BNEP_Write of bnep_api.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-74947856.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDgoogle/android7 versions+6

▶CVEListV5google_inc/androidAndroid-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

GHSA

GHSA-g52j-mjhv-jcpc: In BNEP_Write of bnep_api↗2022-05-14

▶

CVEList

CVE-2018-9357: In BNEP_Write of bnep_api↗2018-11-06

▶

📋Vendor Advisories

Android

CVE-2018-9357: Android Security Bulletin 2018-06-01 CVE: CVE-2018-9357 Severity: CRITICAL Type: RCE Affected AOSP versions: 6↗2018-06-01

▶