Live › vulnerability › CVE-2011-1823
Go to dashboardThe vold volume manager daemon on Android trusts messages arriving over a PF_NETLINK socket, so a local app can make it run code. The attacker gets root privileges on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Android Android OS | vendor | – | – |
| google android | vendor | >= 2.0, < 2.3.4 | 2.3.4 |
| google android | vendor | = 3.0 | – |
Check the Android security patch level in Settings > About phone; the sources do not name the patched level.
Apply the Android security update from the device vendor, as CISA directs; the sources do not name a specific version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
This page as .md · .json · in your agent: get_signal("CVE-2011-1823")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.