{"id":"CVE-2011-1823","kind":"vulnerability","aliases":["CVE-2011-1823"],"related":[],"title":"google android: The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a…","description":"The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.","summary":"The vold volume manager daemon on Android trusts messages arriving over a PF_NETLINK socket, so a local app can make it run code. The attacker gets root privileges on the device.","severity":"high","cvss":7.8,"epss":0.41367,"exploited":true,"exploited_at":"2022-09-08T00:00:00+00:00","products":[{"name":"Android Android OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google android","fixed":["2.3.4"],"affected":">= 2.0, < 2.3.4","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"= 3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","android-devices","exploited","infrastructure","mobile"],"not_affected_if":["patched-device"],"how_to_check":"Check the Android security patch level in Settings > About phone; the sources do not name the patched level.","fix":"Apply the Android security update from the device vendor, as CISA directs; the sources do not name a specific version.","status":"open","published_at":"2011-06-09T10:36:27+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:44+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:10:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Android security update from the device vendor, as CISA directs; the sources do not name a specific version.","reach":"local","impact":"high","summary":"The vold volume manager daemon on Android trusts messages arriving over a PF_NETLINK socket, so a local app can make it run code. The attacker gets root privileges on the device.","category":"infrastructure","who_cares":["android","mobile","android-devices"],"confidence":0.7,"needs_auth":"no","worst_case":"Local app gains root on the Android device and controls everything on it.","analyst_note":"Find the affected Android versions and patched security bulletin (2011 era) at the vendor bulletins or the NVD entry for CVE-2011-1823.","how_to_check":"Check the Android security patch level in Settings > About phone; the sources do not name the patched level.","needs_analyst":true,"not_affected_if":["patched-device"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000457,"input_tokens":2858,"output_tokens":343,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1823':23A,26A '-2011':22A,25A '2':12A,82C '2.3.4':15A,85C '3.0':10A,80C 'allow':97C 'android':2A,9A,27A,28A,31A,33A,34B,36B,47B,79C 'android-devic':35B 'app':59B 'arbitrari':102C 'arriv':50B 'attack':66B 'bypass':113C 'check':120C 'code':64B,103C 'corrupt':129C 'cve':21A,24A 'daemon':7A,45B,77C 'demonstr':131C 'devic':37B,72B 'directvolum':123C 'execut':101C 'exploit':38B 'gain':105C 'get':67B 'gingerbreak':133C 'googl':1A 'google':30A,32A 'handlepartitionad':124C 'index':111C 'infrastructur':39B 'integ':119C 'local':58B,98C 'make':61B 'manag':6A,44B,76C 'maximum':116C 'maximum-on':115C 'memori':128C 'messag':17A,49B,87C 'method':125C 'mobil':40B 'negat':110C 'netlink':54B,94C 'os':29A 'pf':53B,93C 'privileg':69B,107C 'receiv':20A,90C 'root':68B,106C 'run':63B 'sign':118C 'socket':55B,95C 'trigger':127C 'trust':16A,48B,86C 'user':99C 'via':108C 'vold':4A,42B,74C 'volum':5A,43B,75C 'x':13A,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2011-06-09T10:36:27+00:00","kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2011-1823","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1823","severity":null,"published_at":"2022-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2011-1823","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-1823","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2011-1823","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1823","severity":null,"published_at":"2011-06-09T10:36:27+00:00","modified_at":"2026-06-16T23:30:11+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}