The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Android | 2.1 (including) | 2.1 (including) | |
| Android | 2.2 (including) | 2.2 (including) | |
| Android | 2.2-rev1 (including) | 2.2-rev1 (including) | |
| Android | 2.2.1 (including) | 2.2.1 (including) | |
| Android | 2.2.2 (including) | 2.2.2 (including) | |
| Android | 2.2.3 (including) | 2.2.3 (including) | |
| Android | 2.3-rev1 (including) | 2.3-rev1 (including) | |
| Android | 2.3.1 (including) | 2.3.1 (including) | |
| Android | 2.3.2 (including) | 2.3.2 (including) | |
| Android | 2.3.3 (including) | 2.3.3 (including) | |
| Android | 3.0 (including) | 3.0 (including) |