Vulnerability in Google Android
CVE-2011-1149
Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK.
EPSS: 0.003 (24.4th percentile) — read the EPSS interpretation.
Affected products
- Google Android — versions 1.5, 1.6, 2.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (Patch, x_refsource_MISC)
- secalert@redhat.com (Exploit, x_refsource_MISC)
Frequently asked questions
- What is CVE-2011-1149?
- CVE-2011-1149 is a vulnerability in Google Android, classified under CWE-264. Published 2011-04-21.
- Is CVE-2011-1149 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.