The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
Vector
LOCAL
Complexity
LOW
Authentication
NONE
Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE
Google Android Operating System 2.3.1
Google Android Operating System 2.2.2
Google Android Operating System 2.3 Revision 1
Google Android Operating System 2.3.2
Google Android Operating System 2.1
Google Android Operating System 2.2.3
Google Android Operating System 3.0
Google Android Operating System 2.3.3
Google Android Operating System 2.2
Google Android Operating System 2.2.1
Google Android Operating System 2.2 Revision 1