Android 'vold' Privilege Escalation VulnerabilityID: oval:org.secpod.oval:def:6504 | Date: (C)2012-06-25 (M)2023-11-13 |
Class: VULNERABILITY | Family: undefined |
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.