CVE-2018-9387
Published: 18 January 2025
Summary
CVE-2018-9387 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 6.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the specific integer overflow flaw in mnh-sm.c that causes the heap overflow.
Provides memory protection mechanisms such as non-executable heaps and address randomization to block exploitation of the heap overflow for privilege escalation.
Mandates validation of inputs to functions in mnh-sm.c to avert integer overflows triggered by local attacker-controlled data.
NVD Description
In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
more
exploitation.
Deeper analysisAI
CVE-2018-9387 is a heap overflow vulnerability stemming from an integer overflow in multiple functions within mnh-sm.c. This issue affects Android Pixel devices, as documented in the relevant security bulletin.
A local attacker with low privileges (PR:L) can exploit the vulnerability with low attack complexity and no user interaction required. Exploitation enables local escalation of privilege without needing additional execution privileges, resulting in high impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is classified under CWE-120.
The Android Pixel security bulletin from June 2018, available at https://source.android.com/security/bulletin/pixel/2018-06-01, details patches and mitigation steps for addressing this vulnerability in affected devices.
Details
- CWE(s)