CVE-2018-9399
📋 TL;DR
CVE-2018-9399 is a local privilege escalation vulnerability in the /proc/driver/wmt_dbg driver that allows attackers to write out of bounds memory. This could enable a local attacker with system execution privileges to gain elevated privileges on affected Android devices. The vulnerability affects certain Android devices, particularly Google Pixel phones.
💻 Affected Systems
- Google Pixel
- Google Pixel XL
- Google Pixel 2
- Google Pixel 2 XL
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges on the device, potentially compromising all user data, installing persistent malware, or bypassing security controls.
Likely Case
Malicious app with system privileges escalates to root access, enabling data theft, surveillance, or device takeover.
If Mitigated
With proper app sandboxing and SELinux policies, impact is limited to the compromised app's context.
🎯 Exploit Status
Requires system execution privileges to trigger. No user interaction needed once the malicious code is running.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android security patch level 2018-06-05
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2018-06-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > Advanced > System update. 2. Install the June 2018 security patch. 3. Reboot the device.
🔧 Temporary Workarounds
Disable wmt_dbg driver
linuxRemove or disable the vulnerable driver module
rmmod wmt_dbg
echo 'blacklist wmt_dbg' >> /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Restrict app installations to trusted sources only via Google Play Protect
- Implement strict SELinux policies to limit driver access
🔍 How to Verify
Check if Vulnerable:
Check if /proc/driver/wmt_dbg exists and device has Android patch level before 2018-06-05Check Version:
getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level is 2018-06-05 or later in Settings > About phone📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux denials for wmt_dbg access
- Abnormal process privilege escalation
Network Indicators:
- None - this is a local exploit
SIEM Query:
process:privilege_escalation AND device_model:(Pixel OR Pixel_XL OR Pixel_2 OR Pixel_2_XL)