ZeroDay Findings
Sign inSign up

Findings

CVE-2011-1823

Android OS Privilege Escalation Vulnerability

Published Jun 9, 2011 · updated Jun 16, 2026 · google android

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 9, 2011 · Catalog

    Detected

    The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

  2. Sep 8, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Sep 29, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Required action

Apply updates per vendor instructions.

CISA due date Sep 29, 2022

Affected

  • cpe google/androidversion unspecified
  • cpe google/android3.0
  • vendor Android Android OSversion unspecified

Sources

  • CISA KEVCVE-2011-1823

    The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.

    cisa.gov
  • CVE.orgCVE-2011-1823

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2011-1823

    30-day exploitation probability 41.4%

    first.org
  • NIST NVDCVE-2011-1823

    The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the

    nvd.nist.gov

References

CVE-2011-1823 · ZeroDay Findings