CVE Vulnerability

CVE-2018-9511

In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288

4.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://source.android.com/security/bulletin/2018-10-01, Broken Link Vendor Advisory
https://android.googlesource.com/platform/system/netd/+/931418b16c7197ca2df34c2a5609e49791125abe Patch Vendor Advisory
http://www.securityfocus.com/bid/105482 Third Party Advisory VDB Entry
https://source.android.com/security/bulletin/2018-10-01 Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*
Information

Published : 2018-10-02 07:29

Updated : 2019-10-03 12:03

NVD link : CVE-2018-9511

Mitre link : CVE-2018-9511

Products Affected
No products.
CWE
CWE-909