CVE-2018-9434
Published: 17 January 2025
Description
In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2018-9434 is a vulnerability in multiple functions of Parcel.cpp that enables bypassing address space layout randomization (ASLR). This issue affects Android components handling parcels, as indicated by the associated security bulletin, and could lead to local escalation of privilege without requiring additional execution privileges or user interaction. The vulnerability is classified under CWE-276 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges (PR:L) can exploit this vulnerability due to its low attack complexity and lack of need for user interaction. Successful exploitation allows escalation of privilege, potentially granting high-impact access to confidentiality, integrity, and availability by defeating ASLR protections.
The Android security bulletin at https://source.android.com/security/bulletin/pixel/2018-07-01 details patches for affected Pixel devices, providing mitigation through updated firmware and software components.
Details
- CWE(s)