CVE-2018-9385
published 2018-11-06CVE-2018-9385: In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege…
PriorityP338high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.0th percentile
In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74128061 References: Upstream kernel.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.16.12-1 (bookworm) | linux 4.16.12-1 (bookworm) |
| google_inc | android | — | — |
| linux | linux_kernel | >= 0 < 4.16.12-1 | 4.16.12-1 |
| linux | linux_kernel | >= 0 < 4.16.12-1 | 4.16.12-1 |
| linux | linux_kernel | >= 0 < 4.16.12-1 | 4.16.12-1 |
| linux | linux_kernel | >= 0 < 4.16.12-1 | 4.16.12-1 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Out-of-bounds write due to incorrect bounds check in drivers/amba/bus.c:driver_override_store()
vendor_redhat·2018-11-07·CVSS 7.8
CVE-2018-9385 [HIGH] CWE-122 kernel: Out-of-bounds write due to incorrect bounds check in drivers/amba/bus.c:driver_override_store()
kernel: Out-of-bounds write due to incorrect bounds check in drivers/amba/bus.c:driver_override_store()
In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74128061 References: Upstream kernel.
It was found that the Linux kernel is vulnerable to an out-of-bounds buffer write due to incorrect bounds check in driver_override_store() function in drivers/amba/bus.c. This can lead to a memory corruption, a system panic, and to a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe
Debian
CVE-2018-9385: linux - In driver_override_store of bus.c, there is a possible out of bounds write due t...
vendor_debian·2018·CVSS 7.8
CVE-2018-9385 [HIGH] CVE-2018-9385: linux - In driver_override_store of bus.c, there is a possible out of bounds write due t...
In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74128061 References: Upstream kernel.
Scope: local
bookworm: resolved (fixed in 4.16.12-1)
bullseye: resolved (fixed in 4.16.12-1)
forky: resolved (fixed in 4.16.12-1)
sid: resolved (fixed in 4.16.12-1)
trixie: resolved (fixed in 4.16.12-1)
GHSA
GHSA-x85p-qff8-qjww: In driver_override_store of bus
ghsa_unreviewed·2022-05-14
CVE-2018-9385 [HIGH] CWE-787 GHSA-x85p-qff8-qjww: In driver_override_store of bus
In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74128061 References: Upstream kernel.
OSV
CVE-2018-9385: In driver_override_store of bus
osv·2018-11-06·CVSS 7.8
CVE-2018-9385 [HIGH] CVE-2018-9385: In driver_override_store of bus
In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74128061 References: Upstream kernel.
No detection rules found.
No public exploits indexed.
2018-11-06
Published