Description

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	Android	Kernel

References

http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlPatch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/38Mailing List, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-enThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/11Mailing List, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191031-0005/Third Party Advisory
https://source.android.com/security/bulletin/2019-10-01Vendor Advisory
https://usn.ubuntu.com/4186-1/Third Party Advisory
http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlPatch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/38Mailing List, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-enThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/11Mailing List, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191031-0005/Third Party Advisory
https://source.android.com/security/bulletin/2019-10-01Vendor Advisory
https://usn.ubuntu.com/4186-1/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215US Government Resource

Timeline

Published: Oct 11, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed