Android OS Privilege Escalation Vulnerability

HOCH 7.8EXPLOITED (CISA KEV)CVE-2011-1823 · Published 09/06/2011 · updated 16/06/2026

Android OS Privilege Escalation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 08/09/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
Android OS Android	Versions not published yet (product named by CISA KEV)

Description

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

References

android.git.kernel.org · Broken Link
android.git.kernel.org · Broken Link
android.git.kernel.org · Broken Link
androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421 · Broken Link
c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html · Exploit
forum.xda-developers.com/showthread.php · Exploit
androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now · Press/Media Coverage
xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/67977 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2011-1823

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free