CVE-2018-9387
Published: 18 January 2025
Summary
CVE-2018-9387 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-9387 is a heap overflow vulnerability stemming from an integer overflow in multiple functions within mnh-sm.c. This issue affects Android Pixel devices, as documented in the relevant security bulletin.
A local attacker with low privileges (PR:L) can exploit the vulnerability with low attack complexity and no user interaction required. Exploitation enables local escalation of privilege without needing additional execution privileges, resulting in high impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is classified under CWE-120.
The Android Pixel security bulletin from June 2018, available at https://source.android.com/security/bulletin/pixel/2018-06-01, details patches and mitigation steps for addressing this vulnerability in affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-20981
Vulnerability details
In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
more
exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap overflow in Android kernel/media component directly enables privilege escalation via exploitation of a software vulnerability (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the specific integer overflow flaw in mnh-sm.c that causes the heap overflow.
Provides memory protection mechanisms such as non-executable heaps and address randomization to block exploitation of the heap overflow for privilege escalation.
Mandates validation of inputs to functions in mnh-sm.c to avert integer overflows triggered by local attacker-controlled data.