CVE-2011-1823

KEVAndroid OS Privilege Escalation Vulnerability

Description

The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedJun 9, 2011

Last modifiedJun 16, 2026

Added to KEVSep 8, 2022

Remediation dueSep 29, 2022

References

android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a5d6Broken Link
android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd2934836fBroken Link
android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be0430849837d6fdc5352eBroken Link
androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/Broken Link
c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.htmlExploitIssue Tracking
forum.xda-developers.com/showthread.php?t=1044765ExploitIssue Tracking
androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/Press/Media Coverage
xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/67977Third Party AdvisoryVDB Entry
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1823US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1489 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 41.4% · top 1% of all CVEs
Weakness: CWE-190

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.