Description
In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no additional privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-74250718 References: Upstream kernel.
References (4)
Core 4
Core References
Issue Tracking x_refsource_misc
https://bugzilla.suse.com/show_bug.cgi?id=1102001&_ga=2.244341506.661832603.1561012452-1774095668.1553066022
Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html
Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html
Patch, Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2018-07-01
Scores
CVSS v3
7.8
EPSS
0.0022
EPSS Percentile
12.0%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (3)
debian/debian_linux
8.0
debian/debian_linux
9.0
google/android
Published
Nov 06, 2018
Tracked Since
Feb 18, 2026