CVE-2018-9382
Published: 17 January 2025
Description
In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2018-9382 is a vulnerability in multiple functions of WifiServiceImpl.java within the Android framework, particularly affecting Pixel devices. The issue arises from a missing permission check (CWE-862: Missing Authorization), which allows activation of the Wi-Fi hotspot from a non-owner profile. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges (PR:L), such as one operating from a non-owner user profile on the device, can exploit this flaw without needing user interaction or additional execution privileges. Exploitation enables local escalation of privilege, potentially compromising high levels of confidentiality, integrity, and availability (C:H/I:H/A:H) by gaining unauthorized control over Wi-Fi hotspot functionality.
The Android security bulletin for Pixel devices, published on June 1, 2018, details patches and mitigation steps at https://source.android.com/security/bulletin/pixel/2018-06-01. Security practitioners should ensure affected devices receive these updates to prevent exploitation.
Details
- CWE(s)