{"api_version":"1","generated_at":"2026-07-23T08:31:17+00:00","cve":"CVE-2018-9511","urls":{"html":"https://cve.report/CVE-2018-9511","api":"https://cve.report/api/cve/CVE-2018-9511.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-9511","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-9511"},"summary":{"title":"CVE-2018-9511","description":"In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288","state":"PUBLIC","assigner":"security@android.com","published_at":"2018-10-02 19:29:00","updated_at":"2023-11-07 03:01:00"},"problem_types":["CWE-909"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/105482","name":"105482","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://source.android.com/security/bulletin/2018-10-01,","name":"https://source.android.com/security/bulletin/2018-10-01,","refsource":"CONFIRM","tags":["Broken Link","Vendor Advisory"],"title":"404  |  Page Not Found  |  Android Open Source Project","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://android.googlesource.com/platform/system/netd/+/931418b16c7197ca2df34c2a5609e49791125abe","name":"https://android.googlesource.com/platform/system/netd/+/931418b16c7197ca2df34c2a5609e49791125abe","refsource":"MISC","tags":["Patch","Vendor Advisory"],"title":"931418b16c7197ca2df34c2a5609e49791125abe - platform/system/netd - Git at Google","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://source.android.com/security/bulletin/2018-10-01%2C","name":"https://source.android.com/security/bulletin/2018-10-01%2C","refsource":"","tags":[],"title":"404  |  Page Not Found  |  Android Open Source Project","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://source.android.com/security/bulletin/2018-10-01","name":"https://source.android.com/security/bulletin/2018-10-01","refsource":"MISC","tags":["Patch","Vendor Advisory"],"title":"Android Security Bulletin—October 2018  |  Android Open Source Project","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9511","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9511","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"9511","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"9511","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@android.com","DATE_PUBLIC":"2018-10-02T00:00:00","ID":"CVE-2018-9511","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Android","version":{"version_data":[{"version_value":"Android-9.0"}]}}]},"vendor_name":"Google Inc."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Denial of service"}]}]},"references":{"reference_data":[{"name":"105482","refsource":"BID","url":"http://www.securityfocus.com/bid/105482"},{"name":"https://source.android.com/security/bulletin/2018-10-01,","refsource":"CONFIRM","url":"https://source.android.com/security/bulletin/2018-10-01,"},{"name":"https://android.googlesource.com/platform/system/netd/+/931418b16c7197ca2df34c2a5609e49791125abe","refsource":"MISC","url":"https://android.googlesource.com/platform/system/netd/+/931418b16c7197ca2df34c2a5609e49791125abe"}]}},"nvd":{"publishedDate":"2018-10-02 19:29:00","lastModifiedDate":"2023-11-07 03:01:00","problem_types":["CWE-909"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:N/A:C","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE","baseScore":4.9},"severity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"9511","Ordinal":"125925","Title":"CVE-2018-9511","CVE":"CVE-2018-9511","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"9511","Ordinal":"1","NoteData":"In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288","Type":"Description","Title":null},{"CveYear":"2018","CveId":"9511","Ordinal":"2","NoteData":"2018-10-02","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"9511","Ordinal":"3","NoteData":"2018-10-04","Type":"Other","Title":"Modified"}]}}}