Vulnerability record · CVE-2011-1823 · published 9 June 2011
CVE-2011-1823: Android vold integer overflow allows local root privilege escalation
Google · Android
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages received over a PF_NETLINK socket and fails to validate a negative index in DirectVolume::handlePartitionAdded, causing memory corruption. A local user can exploit this to execute arbitrary code and gain root, as demonstrated by the Gingerbreak tool.
Description
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe vulnerability is in CISA KEV with a high EPSS score and public exploit code, but it requires local access and affects only legacy Android versions.
What it is
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages received over a PF_NETLINK socket and fails to validate a negative index in DirectVolume::handlePartitionAdded, causing memory corruption. A local user can exploit this to execute arbitrary code and gain root, as demonstrated by the Gingerbreak tool.
Impact
An attacker with local access gains root privileges on the device, breaking the Android application sandbox and allowing full control of the system.
Attack surface
The flaw is reached locally by sending crafted messages to the vold daemon over a PF_NETLINK socket; the CVSS vector (AV:L/PR:L/UI:N) indicates low privileges are required and no user interaction is needed.
Exploitation
CVE-2011-1823 is listed in CISA KEV with a due date of 2022-09-29, and EPSS shows a 30-day probability of 0.41634 (98.6th percentile); multiple references are tagged Exploit, including the Gingerbreak demonstration.
What to do
- Apply the vendor patch by updating Android to 2.3.4 or later, or the corresponding fixed build for affected devices.
- If patching is not possible, restrict local access and avoid installing untrusted applications on affected devices.
- Monitor for and remove known rooting tools such as Gingerbreak on managed devices.
- Enforce device management policies that prevent sideloading of untrusted APKs.
Detection
- Monitor for unexpected root processes or su binary execution on Android devices.
- Audit application installs for known exploit packages such as Gingerbreak.
- Check device build versions against the fixed Android 2.3.4 baseline.
- Review logs for abnormal vold or netlink activity indicative of crafted messages.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2011-1823 to the Known Exploited Vulnerabilities catalog on 8 September 2022 as "Android OS Privilege Escalation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 29 September 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-1823 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-1823), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
