Published: 19/06/2019 Updated: 24/08/2020

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app to add or replace a HAL service with its own service, gaining code execution in a privileged process.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9Android ID: A-121035042Upstream kernel

Vulnerable Product	Search on Vulmon	Subscribe to Product
google android 8.1
google android 8.0
google android 9.0

We already reported four bugs in Android that are caused by the use of getpidcon(), which is fundamentally unsafe: bugschromiumorg/p/project-zero/issues/detail?id=727 (AndroidID-27111481; unexploitable) bugschromiumorg/p/project-zero/issues/detail?id=851 (AndroidID-29431260; getpidcon() used in the servicemanager) bug ...

CWE-732 https://source.android.com/security/bulletin/2019-03-01 https://nvd.nist.gov https://www.exploit-db.com/exploits/46504

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-2023

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect