CVE-2018-9445
published 2018-11-06CVE-2018-9445: In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when mounting a…
PriorityP434medium6.8CVSS 3.0
AVPACLPRNUINSUCHIHAH
EXPLOIT
EPSS
0.82%
53.5th percentile
In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when mounting a USB device with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-80436257.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| google_inc | android | — | — |
CVSS provenance
nvdv3.06.8MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xqhw-7jhx-gmrc: In readMetadata of Utils
ghsa_unreviewed·2022-05-14
CVE-2018-9445 [HIGH] CWE-22 GHSA-xqhw-7jhx-gmrc: In readMetadata of Utils
In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when mounting a USB device with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-80436257.
Project0
OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB - Project Zero
project_zero·2018-09-01·CVSS 6.8
CVE-2018-9445 [MEDIUM] OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB - Project Zero
Posted by Jann Horn, Google Project Zero
Recently, there has been some attention around the topic of physical attacks on smartphones, where an attacker with the ability to connect USB devices to a locked phone attempts to gain access to the data stored on the device. This blogpost describes how such an attack could have been performed against Android devices (tested with a Pixel 2).
After an Android phone has been unlocked once on boot (on newer devices, using the "Unlock for all features and data" screen; on older devices, using the "To start Android, enter your password" screen), it retains the encryption keys used to decrypt files in kernel memory even when the screen is locked, and the encrypted filesystem areas or partition(s) stay accessible. Therefore, an attacker who gains the
Android
CVE-2018-9445: Android Security Bulletin 2018-08-01
CVE: CVE-2018-9445
Severity: HIGH
Type: EoP
Affected AOSP versions: 6
vendor_android·2018-08-01·CVSS 6.8
CVE-2018-9445 [MEDIUM] CVE-2018-9445: Android Security Bulletin 2018-08-01
CVE: CVE-2018-9445
Severity: HIGH
Type: EoP
Affected AOSP versions: 6
Android Security Bulletin 2018-08-01
CVE: CVE-2018-9445
Severity: HIGH
Type: EoP
Affected AOSP versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
References: A-80436257
[2]
No detection rules found.
Exploit-DB
Android - 'zygote->init;' Chain from USB Privilege Escalation
exploitdb·2018-09-11·CVSS 6.8
CVE-2018-9488 [MEDIUM] Android - 'zygote->init;' Chain from USB Privilege Escalation
Android - 'zygote->init;' Chain from USB Privilege Escalation
---
After reporting https://bugs.chromium.org/p/project-zero/issues/detail?id=1583
(Android ID 80436257, CVE-2018-9445), I discovered that this issue could also
be used to inject code into the context of the zygote. Additionally, I
discovered a privilege escalation path from zygote to init; that escalation path
is why I'm filing a new bug.
Essentially, the privilege escalation from zygote to init is possible because
system/sepolicy/private/zygote.te contains the following rule:
allow zygote self:capability sys_admin;
(On the current AOSP master branch, the rule looks slightly different, but it's
still there.)
This rule allows processes in the zygote domain to use the CAP_SYS_ADMIN
capability, if they have such a capability
Exploit-DB
Android - Directory Traversal over USB via Injection in blkid Output
exploitdb·2018-08-13
CVE-2018-9445 Android - Directory Traversal over USB via Injection in blkid Output
Android - Directory Traversal over USB via Injection in blkid Output
---
When a USB mass storage device is inserted into an Android phone (even if the
phone is locked!), vold will attempt to automatically mount partitions from the
inserted device. For this purpose, vold has to identify the partitions on the
connected device and collect some information about them, which is done in
readMetadata() in system/vold/Utils.cpp. This function calls out to "blkid",
then attempts to parse the results:
std::vector cmd;
cmd.push_back(kBlkidPath);
cmd.push_back("-c");
cmd.push_back("/dev/null");
cmd.push_back("-s");
cmd.push_back("TYPE");
cmd.push_back("-s");
cmd.push_back("UUID");
cmd.push_back("-s");
cmd.push_back("LABEL");
cmd.push_back(path);
std::vector output;
status_t res = ForkExecvp(cmd,
No writeups or analysis indexed.
2018-11-06
Published