LiveActive security incident?Get immediate response
CVE Record

CVE-2018-9407: In emmc_rpmb_ioctl of emmc_rpmb.c, there is an Information Disclosure due to a Missing Bounds Check.

In emmc_rpmb_ioctl of emmc_rpmb.c, there is an Information Disclosure due to a Missing Bounds Check. This could lead to Information Disclosure of kernel data.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2018-9407 is an Android Kernel information disclosure issue in the eMMC RPMB ioctl handling. A missing bounds check could allow exposure of kernel data. The supplied sources rate it medium severity with high confidentiality impact, but they do not show active exploitation.

Executive priority

Treat this as a moderate confidentiality risk for affected Android fleets. Prioritize normal mobile patch governance, especially for devices handling sensitive data, but do not escalate as actively exploited based on the supplied evidence.

Technical view

The issue is a CWE-125 out-of-bounds read in emmc_rpmb_ioctl within emmc_rpmb.c. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating adjacent attack vector, low complexity, no privileges, no user interaction, and confidentiality-only impact.

Likely exposure

Exposure is limited to Android Kernel builds containing the vulnerable eMMC RPMB driver path referenced by the Pixel June 2018 bulletin. The source bundle does not identify broader OEM device lists, exact kernel versions, or package names.

Exploitation context

The source bundle does not cite exploitation in the wild, and KEV is false. The CVSS vector suggests exploitation would require adjacent access, with no privileges or user interaction, but the provided sources do not describe exploit prerequisites beyond that.

Researcher notes

Evidence is concise: missing bounds check, information disclosure, CWE-125, and CVSS 6.5. The bundle does not provide commit IDs, exact affected kernel ranges, proof-of-concept status, or detailed remediation text, so validation should rely on vendor bulletin mapping and source review.

Mitigation direction

  • Review the Pixel June 2018 security bulletin and vendor guidance.
  • Apply relevant Android, Pixel, OEM, or carrier security updates where applicable.
  • Prioritize devices using affected Android Kernel eMMC RPMB functionality.
  • Track unsupported devices separately if vendor fixes are unavailable.
  • Do not assume third-party fixes without vendor confirmation.

Validation and detection

  • Inventory Android devices and kernel builds in scope.
  • Compare device patch levels against the Pixel June 2018 bulletin.
  • Check vendor advisories for OEM-specific affected build information.
  • For source-managed kernels, review emmc_rpmb_ioctl bounds handling.
  • Confirm scanners map findings to CVE-2018-9407 accurately.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-125: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-9407 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2018-9407Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleAndroidKernelunaffected
Weakness

CWE details

CWE-125

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-125 · source CWE mapping

Out-of-bounds Read

Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs