In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
| Link | Resource |
|---|---|
| https://source.android.com/security/bulletin/2018-07-01 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Jun 2026, 02:06
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) En writeInplace de Parcel.cpp, existe una posible fuga de información entre procesos, usando Binder, debido a datos no inicializados. Esto podría llevar a una revelación de información local sin necesidad de privilegios de ejecución adicionales. No se necesita interacción del usuario para la explotación. |
22 Nov 2024, 22:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:* cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* |
|
| References | () https://source.android.com/security/bulletin/2018-07-01 - Patch, Vendor Advisory | |
| First Time |
Google
Google android |
20 Nov 2024, 16:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-908 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| Summary |
|
19 Nov 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-19 22:15
Updated : 2026-06-17 02:06
NVD link : CVE-2018-9421
Mitre link : CVE-2018-9421
CVE.ORG link : CVE-2018-9421
JSON object : View
Products Affected
- android
CWE
CWE-908
Use of Uninitialized Resource