CVE-2018-9388
📋 TL;DR
CVE-2018-9388 is a critical memory corruption vulnerability in STMicroelectronics touchscreen drivers for Android devices. It allows attackers to execute arbitrary code with kernel privileges through out-of-bounds writes, potentially leading to full device compromise. This primarily affects Android devices using STM touchscreen controllers.
💻 Affected Systems
- Android devices with STMicroelectronics FTS/FTM4 touchscreen controllers
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover with kernel-level privileges, allowing installation of persistent malware, data theft, and bypassing all security controls.
Likely Case
Local privilege escalation from a compromised app to kernel-level access, enabling further system compromise and persistence.
If Mitigated
Limited impact if SELinux policies restrict driver access and devices are not rooted or running untrusted apps.
🎯 Exploit Status
Exploitation requires local code execution through a malicious app. Multiple proof-of-concepts exist demonstrating privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android security patch level 2018-06-05 or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2018-06-01
Restart Required: Yes
Instructions:
1. Apply Android security patch from June 2018 or later. 2. Update device firmware through official channels. 3. Reboot device after update.
🔧 Temporary Workarounds
Disable touchscreen driver (not recommended)
linuxPrevents exploitation by disabling the vulnerable driver, but breaks touchscreen functionality
rmmod ftm4_pdc
Restrict app installations
allOnly install apps from trusted sources like Google Play Store
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement strict app installation policies and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android security patch level. If before June 2018, likely vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level is 2018-06-05 or later. Check kernel version includes fixes for CVE-2018-9388.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Unexpected driver crashes in dmesg
- SELinux denials for touchscreen driver
Network Indicators:
- Unusual outbound connections from system processes
SIEM Query:
source="android" AND (event_id="kernel_panic" OR process_name="ftm4_pdc")