CVE-2019-2215

Published Oct 11, 2019

Last updated 6 months ago

Exploit knownCVSS high 7.8
Android
Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2019-2215 is a use-after-free (UAF) vulnerability found in the `binder.c` file of the Linux Kernel, specifically within the Binder kernel driver. This flaw allows an application to achieve an elevation of privilege to the Linux Kernel, meaning a malicious application could gain higher-level access than intended. No user interaction is required for an application to exploit this vulnerability. The vulnerability stems from a `binder_thread` struct being freed, but a pointer to its `wait` member (of type `wait_queue_head_t`) is still referenced by `epoll`, leading to a use-after-free condition when `remove_wait_queue` is called. While the issue was patched in the upstream Linux kernel in late 2017, the fix was not consistently applied to all Android versions, leaving many devices vulnerable. This oversight allowed for its exploitation in the wild, potentially enabling a local privileged attacker or app to gain root access and full control of a compromised device.

Description
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
Source
security@android.com
NVD status
Modified
Products
android, debian_linux, ubuntu_linux, cloud_backup, data_availability_services, hci_management_node, service_processor, solidfire, steelstore_cloud_integrated_storage, solidfire_baseboard_management_controller_firmware, aff_baseboard_management_controller_firmware, a320_firmware, c190_firmware, a220_firmware, fas2720_firmware, fas2750_firmware, a800_firmware, h300s_firmware, h500s_firmware, h700s_firmware, h410s_firmware, h410c_firmware, h610s_firmware, alp-al00b_firmware, alp-tl00b_firmware, anne-al00_firmware, ares-al00b_firmware, ares-al10d_firmware, ares-tl00chw_firmware, bla-al00b_firmware, bla-l29c_firmware, bla-tl00b_firmware, barca-al00_firmware, berkeley-l09_firmware, berkeley-tl10_firmware, columbia-al00a_firmware, columbia-l29d_firmware, cornell-tl10b_firmware, duke-l09i_firmware, dura-al00a_firmware, figo-al00a_firmware, florida-al20b_firmware, florida-l03_firmware, florida-l21_firmware, florida-l22_firmware, florida-tl10b_firmware, mate_rs_firmware, p20_firmware, p20_lite_firmware, y9_2019_firmware, nova_2s_firmware, nova_3_firmware, nova_3e_firmware, honor_view_20_firmware, jakarta-al00a_firmware, johnson-tl00d_firmware, leland-al10b_firmware, leland-l21a_firmware, leland-l32a_firmware, leland-tl10b_firmware, leland-tl10c_firmware, lelandp-al00c_firmware, lelandp-l22c_firmware, neo-al00d_firmware, princeton-al10b_firmware, rhone-al00_firmware, stanford-l09_firmware, stanford-l09s_firmware, sydney-al00_firmware, sydney-tl00_firmware, sydneym-al00_firmware, tony-al00b_firmware, tony-tl00b_firmware, yale-al00a_firmware, yale-l21a_firmware, yale-tl00b_firmware, honor_9i_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
4.6
Impact score
6.4
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:P/I:P/A:P

Known exploits

Data from CISA

Vulnerability name
Android Kernel Use-After-Free Vulnerability
Exploit added on
Nov 3, 2021
Exploit action due
May 3, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov
CWE-416
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-416

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.