CVE-2011-1823: Android OS Privilege Escalation Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-09-08. EPSS: 41.4% chance of exploitation in the next 30 days.

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Affected products

• Google Android: from 2.0, before 2.3.4 (fixed in 2.3.4); version 3.0 only

Published 2011-06-09. Last modified 2026-06-16.