Published: 14/11/2018 Updated: 17/12/2018

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1

VMScore: 614

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-113027383

Vulnerable Product	Search on Vulmon	Subscribe to Product
google android 9.0
google android 8.1
google android 8.0

PoC code for CVE-2018-9539

CVE-2018-9539 Proof-of-concept code for CVE-2018-9539 If you have any questions, you are welcome to DM me on Twitter (@tamir_zb) Build In order to build this: Download the Android source code Put this repository in AOSP/external Run the following commands: cd AOSP source build/envsetupsh make cas_race_uaf Result Running this PoC aga

CWE-362 https://source.android.com/security/bulletin/2018-11-01 http://www.securityfocus.com/bid/105865 https://nvd.nist.gov https://github.com/tamirzb/CVE-2018-9539

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2018-9539

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect