CVE-2019-2215

Published Oct 11, 2019

Last updated 9 months ago

Exploit knownCVSS high 7.8
Android
Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2019-2215 is a use-after-free (UAF) vulnerability found in the `binder.c` file of the Linux Kernel, specifically within the Binder kernel driver. This flaw allows an application to achieve an elevation of privilege to the Linux Kernel, meaning a malicious application could gain higher-level access than intended. No user interaction is required for an application to exploit this vulnerability. The vulnerability stems from a `binder_thread` struct being freed, but a pointer to its `wait` member (of type `wait_queue_head_t`) is still referenced by `epoll`, leading to a use-after-free condition when `remove_wait_queue` is called. While the issue was patched in the upstream Linux kernel in late 2017, the fix was not consistently applied to all Android versions, leaving many devices vulnerable. This oversight allowed for its exploitation in the wild, potentially enabling a local privileged attacker or app to gain root access and full control of a compromised device.

Description
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
Source
security@android.com
NVD status
Modified
Products
android, debian_linux, ubuntu_linux, cloud_backup, data_availability_services, hci_management_node, service_processor, solidfire, steelstore_cloud_integrated_storage, solidfire_baseboard_management_controller_firmware, aff_baseboard_management_controller_firmware, a320_firmware, c190_firmware, a220_firmware, fas2720_firmware, fas2750_firmware, a800_firmware, h300s_firmware, h500s_firmware, h700s_firmware, h410s_firmware, h410c_firmware, h610s_firmware, alp-al00b_firmware, alp-tl00b_firmware, anne-al00_firmware, ares-al00b_firmware, ares-al10d_firmware, ares-tl00chw_firmware, bla-al00b_firmware, bla-l29c_firmware, bla-tl00b_firmware, barca-al00_firmware, berkeley-l09_firmware, berkeley-tl10_firmware, columbia-al00a_firmware, columbia-l29d_firmware, cornell-tl10b_firmware, duke-l09i_firmware, dura-al00a_firmware, figo-al00a_firmware, florida-al20b_firmware, florida-l03_firmware, florida-l21_firmware, florida-l22_firmware, florida-tl10b_firmware, mate_rs_firmware, p20_firmware, p20_lite_firmware, y9_2019_firmware, nova_2s_firmware, nova_3_firmware, nova_3e_firmware, honor_view_20_firmware, jakarta-al00a_firmware, johnson-tl00d_firmware, leland-al10b_firmware, leland-l21a_firmware, leland-l32a_firmware, leland-tl10b_firmware, leland-tl10c_firmware, lelandp-al00c_firmware, lelandp-l22c_firmware, neo-al00d_firmware, princeton-al10b_firmware, rhone-al00_firmware, stanford-l09_firmware, stanford-l09s_firmware, sydney-al00_firmware, sydney-tl00_firmware, sydneym-al00_firmware, tony-al00b_firmware, tony-tl00b_firmware, yale-al00a_firmware, yale-l21a_firmware, yale-tl00b_firmware, honor_9i_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
4.6
Impact score
6.4
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:P/I:P/A:P

Known exploits

Data from CISA

Vulnerability name
Android Kernel Use-After-Free Vulnerability
Exploit added on
Nov 3, 2021
Exploit action due
May 3, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov
CWE-416
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-416

Social media

Hype score
Not currently trending

  1. Android: - CVE-2024-0044: https://t.co/tLsam6sZWc (bypasses initial patch for run-as vuln) - CVE-2019-2215: https://t.co/gXWdBtcvoP (use-after-free in Binder) iOS: Public GitHub POCs are rare, but check CVE-2019-8605 resources at https://t.co/0ZtYMSL4G7. Use responsibly! 😂

    @Hermes_tooll

    15 Mar 2026

    5842 Impressions

    15 Retweets

    87 Likes

    56 Bookmarks

    2 Replies

    0 Quotes

Configurations

Related CVEs

  1. In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completion then reads it: tipc_aead_decrypt_done() dereferences aead->crypto->stats and aead->crypto->net, and tipc_crypto_rcv_complete() dereferences aead->crypto->aead[] and the node table -- reading freed memory. Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO): BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999) Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51 Workqueue: events_unbound Call Trace: tipc_aead_decrypt_done (net/tipc/crypto.c:999) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 169: __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) tipc_crypto_start (net/tipc/crypto.c:1502) tipc_init_net (net/tipc/core.c:72) ops_init (net/core/net_namespace.c:137) setup_net (net/core/net_namespace.c:446) copy_net_ns (net/core/net_namespace.c:579) create_new_namespaces (kernel/nsproxy.c:132) __x64_sys_unshare (kernel/fork.c:3316) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Freed by task 8: kfree (mm/slub.c:6566) tipc_exit_net (net/tipc/core.c:119) cleanup_net (net/core/net_namespace.c:704) process_one_work (kernel/workqueue.c:3314) kthread (kernel/kthread.c:436) This is the same class of bug that commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") fixed for the encrypt side. The encrypt path takes maybe_get_net(aead->crypto->net) before crypto_aead_encrypt() and drops it with put_net() on the synchronous return paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY return keeps the reference for the async callback to release. The decrypt path was left without the equivalent guard. Mirror the encrypt-side fix on the decrypt path: take a net reference before crypto_aead_decrypt() (failing with -ENODEV and the matching bearer put if it cannot be acquired), keep it across the -EINPROGRESS/-EBUSY async return, and drop it with put_net() on the synchronous success/error return and at the end of tipc_aead_decrypt_done(). Reproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is flooded with crafted encrypted frames from an unknown peer (driving the cluster-key decrypt path) while the bearer's netns is repeatedly torn down. The completion must run asynchronously to outlive tipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts synchronously, so the async path was exercised via cryptd offload. The unguarded aead->crypto dereference in tipc_aead_decrypt_done() is the unpatched upstream path; tipc_aead_decrypt() still lacks maybe_get_net(aead->crypto->net), so the completion can outlive the free on any config where crypto_aead_decrypt() goes async. Found by 0sec automated security-research tooling (https://0sec.ai).•CVE-2026-63801
  2. In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.•CVE-2026-14355
  3. GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.•CVE-2026-56968
  4. In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.•CVE-2026-28573
  5. In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.•CVE-2026-28615

References

Sources include official advisories and independent security research.