CVE-2019-2215
Android Kernel Use-After-Free Vulnerability
Description
CVE-2019-2215 is a high-severity use after free vulnerability in the Android Kernel's binder.c component that allows local privilege escalation from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, though it requires either a malicious local application or a separate vulnerability in a network-facing application. CISA has confirmed active exploitation by listing CVE-2019-2215 in its Known Exploited Vulnerabilities catalog. This vulnerability was notably chained with CVE-2020-0041 and CVE-2020-0069 in the "AbstractEmu" exploit chain, and with an EPSS score of 52.9% (97.9th percentile), exploitation probability is high.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | - | |
| debian | debian linux | 8.0 |
| canonical | ubuntu linux | 16.04 |
| netapp | cloud backup | - |
| netapp | data availability services | - |
| netapp | hci management node | - |
| netapp | service processor | - |
| netapp | solidfire | - |
| netapp | steelstore cloud integrated storage | - |
| netapp | solidfire baseboard management controller firmware | - |
| netapp | aff baseboard management controller firmware | - |
| netapp | a320 firmware | - |
| netapp | c190 firmware | - |
| netapp | a220 firmware | - |
| netapp | fas2720 firmware | - |
| netapp | fas2750 firmware | - |
| netapp | a800 firmware | - |
| netapp | h300s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html(Patch, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2019/Oct/38(Mailing List, Third Party Advisory)
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en(Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html(Mailing List, Third Party Advisory)
- https://seclists.org/bugtraq/2019/Nov/11(Mailing List, Patch, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20191031-0005/(Third Party Advisory)
- https://source.android.com/security/bulletin/2019-10-01(Vendor Advisory)
- https://usn.ubuntu.com/4186-1/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215(US Government Resource)
Weakness Type
CWE-416: Use After Free
In the Android Kernel binder driver, the use after free vulnerability occurs in binder.c where a binder transaction structure is freed but its pointer remains accessible. When the dangling pointer is subsequently dereferenced during inter-process communication operations, an attacker with local access can manipulate the freed memory to achieve kernel-level privilege escalation.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2019-2215 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious local privilege escalation threat. The attack vector is local, meaning the attacker must have code execution on the device, but the attack complexity is low and no user interaction is needed. Only low privileges are required to exploit this vulnerability, making it accessible from any installed application. Successful exploitation grants complete control over confidentiality, integrity, and availability at the kernel level, allowing an attacker to escalate from an unprivileged app to full root access. The EPSS score of 52.9% indicates a high probability of exploitation, and the vulnerability's role in the AbstractEmu exploit chain demonstrates its practical value in real-world attack scenarios targeting Android devices.
Exploit Maturity
CVE-2019-2215 has been confirmed as actively exploited in the wild, with CISA listing it in the Known Exploited Vulnerabilities catalog. Public exploit code is available via Packet Storm Security and a second exploit. The vulnerability was notably used as part of the "AbstractEmu" exploit chain, where it was chained with CVE-2020-0041 (an out-of-bounds write in binder.c) and CVE-2020-0069 (a MediaTek chipset vulnerability) to achieve full device compromise on Android devices. The EPSS score of 52.9% (97.9th percentile) confirms a high likelihood of ongoing exploitation activity.
Remediation
- Apply Android security updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Google addressed this vulnerability in the October 2019 Android Security Bulletin.
- Ensure all Android devices have been updated with the latest available security patches. The fix is included in the Android kernel patches referenced by Android ID A-141720095.
- For devices that no longer receive vendor updates, consider deploying mobile device management (MDM) solutions to restrict app installation to trusted sources only, reducing the risk of malicious applications exploiting this vulnerability.
- Monitor device logs for suspicious binder transaction activity and unusual privilege escalation indicators, particularly signs of root access acquisition by non-system applications.
- Implement network-level controls to prevent the installation of applications from untrusted sources, and conduct security assessments of all installed applications on managed devices.
Technical Details
CVE-2019-2215 is a use after free vulnerability in the Android Kernel binder driver (binder.c), which handles inter-process communication (IPC) on Android devices. The vulnerability occurs when a binder transaction object is freed during a specific sequence of binder operations, but a reference to the freed object persists. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that exploitation requires local access with low privileges and no user interaction. By carefully timing binder operations, an attacker can trigger the use after free condition and manipulate the freed memory to execute arbitrary code in kernel context. This vulnerability is particularly dangerous because it was observed being chained with CVE-2020-0041 and CVE-2020-0069 in the AbstractEmu exploit framework, which automated privilege escalation on Android devices across multiple chipset vendors.
Frequently Asked Questions
Is CVE-2019-2215 being actively exploited?
Yes. CVE-2019-2215 has been actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. It was used as part of the AbstractEmu exploit chain targeting Android devices, combining it with CVE-2020-0041 and CVE-2020-0069 for full device compromise.
What products are affected by CVE-2019-2215?
CVE-2019-2215 primarily affects Google Android devices. Additionally, Debian Linux 8.0, Canonical Ubuntu Linux 16.04, and various NetApp products including Cloud Backup, HCI Management Node, and SolidFire are affected due to shared Linux kernel components.
How do I fix CVE-2019-2215?
Apply the Android security updates from the October 2019 Security Bulletin (Android ID A-141720095). For devices no longer receiving updates, restrict app installation to trusted sources and consider retiring the device. For Linux-based systems, apply the corresponding kernel patches from your distribution.
How severe is CVE-2019-2215?
CVE-2019-2215 has a CVSS 3.1 score of 7.8 (HIGH) and an EPSS score of 52.9% (97.9th percentile). The vulnerability enables kernel-level privilege escalation from any installed application, making it a critical threat to Android device security.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.