CVE-2018-9382
Published: 17 January 2025
Summary
CVE-2018-9382 is a high-severity Missing Authorization (CWE-862) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2018-9382 is a vulnerability in multiple functions of WifiServiceImpl.java within the Android framework, particularly affecting Pixel devices. The issue arises from a missing permission check (CWE-862: Missing Authorization), which allows activation of the Wi-Fi hotspot from a non-owner profile. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges (PR:L), such as one operating from a non-owner user profile on the device, can exploit this flaw without needing user interaction or additional execution privileges. Exploitation enables local escalation of privilege, potentially compromising high levels of confidentiality, integrity, and availability (C:H/I:H/A:H) by gaining unauthorized control over Wi-Fi hotspot functionality.
The Android security bulletin for Pixel devices, published on June 1, 2018, details patches and mitigation steps at https://source.android.com/security/bulletin/pixel/2018-06-01. Security practitioners should ensure affected devices receive these updates to prevent exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-20976
Vulnerability details
In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
more
is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization check directly enables local privilege escalation by allowing unauthorized Wi-Fi hotspot activation from a non-owner profile.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly mitigating the missing permission check allowing non-owner profiles to activate Wi-Fi hotspot.
Applies least privilege to restrict non-owner profiles from performing privileged Wi-Fi hotspot activation leading to escalation.
Implements a reference monitor to mediate all accesses to security-critical resources like WifiServiceImpl functions.