CVE-2018-9382
Published: 17 January 2025
Summary
CVE-2018-9382 is a high-severity Missing Authorization (CWE-862) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access, directly mitigating the missing permission check allowing non-owner profiles to activate Wi-Fi hotspot.
Applies least privilege to restrict non-owner profiles from performing privileged Wi-Fi hotspot activation leading to escalation.
Implements a reference monitor to mediate all accesses to security-critical resources like WifiServiceImpl functions.
NVD Description
In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
more
is not needed for exploitation.
Deeper analysisAI
CVE-2018-9382 is a vulnerability in multiple functions of WifiServiceImpl.java within the Android framework, particularly affecting Pixel devices. The issue arises from a missing permission check (CWE-862: Missing Authorization), which allows activation of the Wi-Fi hotspot from a non-owner profile. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges (PR:L), such as one operating from a non-owner user profile on the device, can exploit this flaw without needing user interaction or additional execution privileges. Exploitation enables local escalation of privilege, potentially compromising high levels of confidentiality, integrity, and availability (C:H/I:H/A:H) by gaining unauthorized control over Wi-Fi hotspot functionality.
The Android security bulletin for Pixel devices, published on June 1, 2018, details patches and mitigation steps at https://source.android.com/security/bulletin/pixel/2018-06-01. Security practitioners should ensure affected devices receive these updates to prevent exploitation.
Details
- CWE(s)