#VU45110 Permissions, Privileges, and Access Controls in Google Android - CVE-2011-1149

Vulnerability identifier: #VU45110

Vulnerability risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-1149

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Google Android
Operating systems & Components / Operating system

Vendor: Google

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Google Android: 1.5 - 1.6, 2.1 - 2.2.1

---

External links
https://android.git.kernel.org/?p=kernel/common.git;a=commit;h=c98a285075f26e2b17a5baa2cb3eb6356a75597e
https://android.git.kernel.org/?p=platform/system/core.git;a=commit;h=25b15be9120bcdaa0aba622c67ad2c835d9e91ca
https://c-skills.blogspot.com/2011/01/adb-trickery-again.html
https://forum.xda-developers.com/wiki/index.php?title=HTC_Vision#Rooting_the_G2
https://groups.google.com/group/android-security-discuss/browse_thread/thread/15f97658c88d6827/e86db04652651971?show_docid=e86db04652651971
https://github.com/tmzt/g2root-kmod/tree/scotty2/scotty2

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.