CVE-2018-9363

HIGH

Android - Integer Overflow in Bluetooth HIDP Report Processing

Title source: llm
STIX 2.1

Description

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.

References (13)

Core 13
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3797-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3797-1/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3820-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3820-2/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2948
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4308
Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2018-06-01
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3822-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3822-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3820-3/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2043
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2029

Scores

CVSS v3 8.4
EPSS 0.0005
EPSS Percentile 16.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-190 CWE-787
Status published
Products (8)
canonical/ubuntu_linux 12.04 (2 CPE variants)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
debian/debian_linux 8.0
debian/debian_linux 9.0
google/android
linux/linux_kernel 3.14 - 3.16.58
Published Nov 06, 2018
Tracked Since Feb 18, 2026