CVE-2011-1823: google android

csirt@kutim:~/threat-intel/cve/CVE-2011-1823

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 41,4%

Kerentanan Integer Overflow or Wraparound pada google android. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 8 September 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Rincian

Terbit di NVD: 9 Juni 2011
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-190: Integer Overflow or Wraparound
EPSS (30 hari): 41,4% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Android OS Privilege Escalation Vulnerability
Masuk KEV: 8 September 2022
Tenggat CISA: 29 September 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
google	android	Versi 2.0 hingga sebelum 2.3.4
google	android	Versi 3.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1823 pemerintah AS
https://exchange.xforce.ibmcloud.com/vulnerabilities/67977 advisory pihak ketiga · vdb entry
http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html exploit · issue tracking
http://forum.xda-developers.com/showthread.php?t=1044765 exploit · issue tracking
http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/ exploit
http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a... broken link
http://android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd29348... broken link
http://android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be0430849837d6fdc53... broken link
http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/ broken link
http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-f... press/media coverage

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.