Android Bluetooth Stack Buffer Overflow Vulnerability in dtif_rc.cc
CVE-2018-9418 Published on December 2, 2024

In handle_app_cur_val_response of dtif_rc.cc, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2018-9418 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2018-9418 has been classified to as a Memory Corruption vulnerability or weakness.


Products Associated with CVE-2018-9418

You can be notified by stack.watch whenever vulnerabilities like CVE-2018-9418 are published in these products:

Google Android
 

What versions of Android are vulnerable to CVE-2018-9418?