CVE-2018-9416

A vulnerability classified as CWE-787 (out-of-bounds write) occurs in the sg_remove_scat function handling the SCSI generic (sg) driver in the Android kernel. Improper operation on scatter-gather memory structures can result in data being written outside the intended memory area (out-of-bounds write). Exploitation of this vulnerability requires System-level execution privileges, but does not require any user interaction.

An attacker with System privileges can cause kernel memory corruption and achieve local privilege escalation on an Android device.

Apply patches available from the vendor according to the references — Pixel security bulletin dated 2018-07-01 (https://source.android.com/security/bulletin/pixel/2018-07-01)

Google Android — versions indicated in the vendor's references (Pixel security bulletin, July 2018)