CVE-2018-9364

In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction is not needed for exploitation.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://source.android.com/security/bulletin/2018-06-01	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

History

17 Jun 2026, 02:06

Type	Values Removed	Values Added
Summary	(es) En el componente LG LAF, hay un comando especial que permite modificar ciertas particiones. Esto podría provocar que se omita el arranque seguro. No se necesita la interacción del usuario para explotar el problema.	(es) En el componente LG LAF, existe un comando especial que permitía la modificación de ciertas particiones. Esto podría llevar a la elusión del arranque seguro. La interacción del usuario no es necesaria para la explotación.

22 Nov 2024, 21:22

Type	Values Removed	Values Added
First Time		Google Google android
References	~~() https://source.android.com/security/bulletin/2018-06-01 -~~	() https://source.android.com/security/bulletin/2018-06-01 - Vendor Advisory
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:o:google:android:-:::::::*

20 Nov 2024, 16:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
Summary		(es) En el componente LG LAF, hay un comando especial que permite modificar ciertas particiones. Esto podría provocar que se omita el arranque seguro. No se necesita la interacción del usuario para explotar el problema.
CWE		CWE-203

19 Nov 2024, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-19 20:15

Updated : 2026-06-17 02:06

NVD link : CVE-2018-9364

Mitre link : CVE-2018-9364

CVE.ORG link : CVE-2018-9364

JSON object : View

Products Affected

google

android

CWE

NVD-CWE-noinfo CWE-203

Observable Discrepancy

{"id": "CVE-2018-9364", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-9364", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-20T16:00:01.420354Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@android.com", "affectedData": [{"vendor": "Google", "product": "Android", "versions": [{"status": "affected", "version": "SoCVersion"}], "defaultStatus": "unaffected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:o:google:android:-:*:*:*:*:*:*:*"], "vendor": "google", "product": "android", "versions": [{"status": "affected", "version": "SoCVersion"}], "defaultStatus": "unknown"}]}], "published": "2024-11-19T20:15:27.493", "references": [{"url": "https://source.android.com/security/bulletin/2018-06-01", "tags": ["Vendor Advisory"], "source": "security@android.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction is not needed for exploitation."}, {"lang": "es", "value": "En el componente LG LAF, existe un comando especial que permit\u00eda la modificaci\u00f3n de ciertas particiones. Esto podr\u00eda llevar a la elusi\u00f3n del arranque seguro. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n."}], "lastModified": "2026-06-17T02:06:28.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}