LiveActive security incident?Get immediate response
CVE Record

CVE-2018-9416: In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause.

In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2018-9416 is a critical Android kernel memory corruption issue in the SCSI generic driver path. The source describes potential local privilege escalation and no user interaction requirement. The bundle does not identify active exploitation, a public exploit, or exact affected device models beyond Android Kernel context.

Executive priority

Treat as high-priority patch validation for Android fleets, especially unmanaged or legacy devices. Business urgency comes from kernel-level privilege escalation potential, not from confirmed exploitation in the provided evidence.

Technical view

The flaw is reported in sg_remove_scat in scsi/sg.c, where memory corruption may occur from an unusual root cause. The CVE text frames impact as local escalation of privilege. The supplied CVSS 4.0 vector is network/no-privilege, which conflicts with the local EoP wording, so exposure analysis should prioritize vendor advisory details.

Likely exposure

Likely exposure is Android devices running affected kernel builds covered by Google or Pixel security guidance around the July 2018 bulletin. The source bundle does not provide precise Android versions, device models, or downstream OEM patch status.

Exploitation context

No active exploitation is stated in the supplied sources, and KEV is false. The CVE description says user interaction is not needed, but it also describes local privilege escalation rather than confirmed remote exploitation.

Researcher notes

Evidence is thin: the bundle names sg_remove_scat in scsi/sg.c and Android Kernel only. The CVSS vector and prose appear inconsistent on attack vector and privileges. Avoid assuming affected OEMs, exploitability from the network, or fixes beyond vendor bulletins.

Mitigation direction

  • Apply relevant Google Android or Pixel security updates from vendor guidance.
  • Check OEM firmware bulletins for backported kernel fixes.
  • Prioritize devices without July 2018 or later comparable kernel patches.
  • Restrict untrusted local app installation where patching is delayed.

Validation and detection

  • Inventory Android devices and kernel patch levels.
  • Compare device patch status against Google and OEM bulletins.
  • Confirm whether affected SCSI generic kernel code is present.
  • Document any devices lacking vendor-supported remediation.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-9416 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE score

Vulnerability scoring details

Base CVSS 4.0 score

10Critical
CVSS 4.0 vector shape for CVE-2018-9416Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleAndroidKernelunaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.