CVE-2018-3593

Vulnerability

In Android before the 2018-04-05 security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear platforms (MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845), a memory management bug exists in the handling of eMBMS (evolved Multimedia Broadcast Multicast Service) requests. Specifically, repeatedly enabling and disabling an eMBMS session can trigger a double-free condition [1]. This occurs because the system does not properly validate state transitions, allowing the same memory region to be freed twice.

Exploitation

An attacker requires the ability to send repeated eMBMS enable and disable requests to the device, which may be achievable from a local application with sufficient permissions (such as carrier-specific apps or root processes). No user interaction beyond the initial trigger is needed. The attack does not require physical proximity; it can be performed over the cellular network if the device is configured to receive eMBMS broadcasts. The sequence involves interleaving enable() and disable() calls on the eMBMS service before the first disable properly cleans up resources [1].

Impact

Successful exploitation results in a double-free memory corruption. This can lead to a denial of service (system crash or reboot) or potentially arbitrary code execution in the kernel context, as memory corruption in the kernel is a common vector for privilege escalation. The attacker could gain elevated privileges sufficient to compromise the entire device [1].

Mitigation

Google released a fix as part of the Android Security Bulletin for April 2018 (security patch level 2018-04-05). Users should apply the OTA update or flash the updated system image for their device. There is no known workaround for unpatched devices. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the available references [1].