Bit Unmap: Attacking Android Ashmem
Summary: Project Zero's Gal Beniamini described a flaw in Android's ashmem shared memory in which the mmap length is computed from bitmap metadata while the munmap length comes from the ASHMEM_GET_SIZE ioctl, letting an attacker unmap an arbitrarily large range of virtual memory. The vulnerability was present in core Android platform code for Marshmallow and Nougat, allowed privilege elevation from any Android application to privileged contexts including system_server, and has been fixed in a recent Android bulletin.
What you should know: Any installed app could reach system_server, one of the most privileged contexts on the device, by exploiting a mismatch between two length arguments that the platform never validated against each other.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026