CVE-2018-9379
📋 TL;DR
This vulnerability allows local attackers to view thumbnail images of deleted photos on Android devices due to a confused deputy issue in the MiniThumbFile component. It affects Android devices running vulnerable versions, requiring no user interaction or special permissions. The disclosure occurs locally without elevating privileges.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical or remote access could recover thumbnail images from deleted photos, potentially exposing sensitive visual information the user believed was permanently removed.
Likely Case
Malicious apps could silently access thumbnail images from deleted photos in the local gallery, compromising user privacy without detection.
If Mitigated
With proper app sandboxing and updated Android versions, the vulnerability is eliminated, preventing unauthorized access to deleted photo thumbnails.
🎯 Exploit Status
Exploitation requires local access but no user interaction. The confused deputy pattern suggests malicious apps could trigger the vulnerable functions to access deleted thumbnails.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2018-06-05 or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2018-06-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > Advanced > System update. 2. Install the June 2018 security patch or later. 3. Reboot the device after installation.
🔧 Temporary Workarounds
Disable thumbnail generation
androidPrevent thumbnail generation for media files to avoid the vulnerable component being used
Use alternative gallery apps
androidInstall third-party gallery applications that don't rely on the vulnerable MiniThumbFile component
🧯 If You Can't Patch
- Restrict physical access to devices and monitor for suspicious app behavior
- Use device encryption and regularly clear media cache to reduce potential data exposure
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If running Android 8.0 or 8.1 with security patch level before 2018-06-05, the device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level is 2018-06-05 or later in Settings > About phone > Android security patch level.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to media provider database
- Multiple thumbnail generation requests from untrusted apps
Network Indicators:
- This is a local vulnerability with no network indicators
SIEM Query:
Look for apps with media permissions accessing thumbnail databases excessively or outside normal patterns