Android 'vold' Use-After-Free Local Privilege Escalation Vulnerability

Bugtraq ID:	50598
Class:	Boundary Condition Error
CVE:	CVE-2011-3874
Remote:	No
Local:	Yes
Published:	Nov 08 2011 12:00AM
Updated:	Feb 01 2012 11:10AM
Credit:	Dan Rosenberg
Vulnerable:	Open Handset Alliance Android 2.3.5 Open Handset Alliance Android 2.3.2 Open Handset Alliance Android 2.3.1 Open Handset Alliance Android 2.0.1 Open Handset Alliance Android 3.5 Open Handset Alliance Android 3.2 Open Handset Alliance Android 3.1 Open Handset Alliance Android 3.0 Open Handset Alliance Android 2.4 Open Handset Alliance Android 2.3.4 Open Handset Alliance Android 2.3 Open Handset Alliance Android 2.2 Open Handset Alliance Android 2.2 Open Handset Alliance Android 2.1.1 Open Handset Alliance Android 2.1 Open Handset Alliance Android 2.0
Not Vulnerable:

Android 'vold' Use-After-Free Local Privilege Escalation Vulnerability

Android is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain elevated privileges on affected devices.

Android 2.2.x (Froyo) and Android 2.4.x (Gingerbread) are vulnerable.

Android 'vold' Use-After-Free Local Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Android 'vold' Use-After-Free Local Privilege Escalation Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Android 'vold' Use-After-Free Local Privilege Escalation Vulnerability

References:

• Android Homepage (Android)
  
• Android: vold stack buffer overflow (Dan Rosenberg)