NVD Vulnerability Detail

CVE-2018-11273

Summary	In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, 'voice_svc_dev' is allocated as a device-managed resource. If error 'cdev_alloc_err' occurs, 'device_destroy' will free all associated resources, including 'voice_svc_dev' leading to a double free.
Publication Date	Sept. 19, 2018, 3:29 a.m.
Registration Date	March 1, 2021, 6:45 p.m.
Last Update	Nov. 21, 2024, 12:43 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:google:android:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components	Patch Vendor Advisory
2	https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components	Patch Vendor Advisory
3	https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=789d4d21c3f1818dcbf74da4a051598e8f53676c	Patch Third Party Advisory
4	https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=789d4d21c3f1818dcbf74da4a051598e8f53676c	Patch Third Party Advisory
5	https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=f34f6271362484c1f87f4176e72a3bfb80ee7711	Patch Third Party Advisory
6	https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=f34f6271362484c1f87f4176e72a3bfb80ee7711	Patch Third Party Advisory
7	https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin	Patch Third Party Advisory
8	https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-415	二重解放	https://cwe.mitre.org/data/definitions/415.html

JVN Vulnerability Information

android における二重解放に関する脆弱性

Title	android における二重解放に関する脆弱性
Summary	android には、二重解放に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 4, 2018, midnight
Registration Date	Dec. 6, 2018, 3:16 p.m.
Last Update	Dec. 6, 2018, 3:16 p.m.

Affected System

Google

Android

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-11273	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11273
National Vulnerability Database (NVD)
2	CVE-2018-11273	https://nvd.nist.gov/vuln/detail/CVE-2018-11273

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-415	https://cwe.mitre.org/data/definitions/415.html

ベンダー情報

No	Name	URL
Android Open Source Project
1	Pixel/Nexus のセキュリティに関する公開情報 - 2018 年 9 月	https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components
Code Aurora Forum
2	drivers: soc: Clean up voice_svc on kernel 4.9	https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=f34f6271362484c1f87f4176e72a3bfb80ee7711
3	September 2018 Code Aurora Security Bulletin	https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
4	voice_svc: Avoid double free in voice_svc driver	https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=789d4d21c3f1818dcbf74da4a051598e8f53676c

Change Log

No	Changed Details	Date of change
1	[2018年12月06日] 掲載	Dec. 6, 2018, 3:16 p.m.