{"id":"CVE-2019-2215","state":"PUBLISHED","title":"A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploi","description":"A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095","publishedAt":"2019-10-11T18:16:48.000Z","updatedAt":"2025-10-21T23:45:29.242Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"google_android","products":["n/a Android"],"affected":[{"vendor":"n/a","product":"Android","versions":[{"version":"Kernel","status":"affected"}]}],"references":["https://source.android.com/security/bulletin/2019-10-01","http://seclists.org/fulldisclosure/2019/Oct/38","http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en","https://security.netapp.com/advisory/ntap-20191031-0005/","https://seclists.org/bugtraq/2019/Nov/11","http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","https://usn.ubuntu.com/4186-1/","https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html","http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html","https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T19:45:56.293Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/2xxx/CVE-2019-2215.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-2215","state":"PUBLISHED","datePublished":"2019-10-11T18:16:48.000Z","dateUpdated":"2025-10-21T23:45:29.242Z","assignerShortName":"google_android","assignerOrgId":"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6","dateReserved":"2018-12-10T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095"}],"affected":[{"vendor":"n/a","product":"Android","versions":[{"version":"Kernel","status":"affected"}]}],"references":[{"url":"https://source.android.com/security/bulletin/2019-10-01","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2019/Oct/38","name":"20191018 CVE 2019-2215 Android Binder Use After Free","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html","tags":["x_refsource_MISC"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20191031-0005/","tags":["x_refsource_CONFIRM"]},{"url":"https://seclists.org/bugtraq/2019/Nov/11","name":"20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","tags":["x_refsource_MISC"]},{"url":"https://usn.ubuntu.com/4186-1/","name":"USN-4186-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html","name":"[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html","name":"[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update","tags":["mailing-list","x_refsource_MLIST"]}],"problemTypes":[{"descriptions":[{"description":"Elevation of privilege","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"google_android","dateUpdated":"2020-03-02T19:06:43.000Z","orgId":"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@android.com","ID":"CVE-2019-2215","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Android","version":{"version_data":[{"version_value":"Kernel"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Elevation of privilege"}]}]},"references":{"reference_data":[{"name":"https://source.android.com/security/bulletin/2019-10-01","refsource":"CONFIRM","url":"https://source.android.com/security/bulletin/2019-10-01"},{"name":"20191018 CVE 2019-2215 Android Binder Use After Free","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2019/Oct/38"},{"name":"http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html"},{"name":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en","refsource":"CONFIRM","url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en"},{"name":"https://security.netapp.com/advisory/ntap-20191031-0005/","refsource":"CONFIRM","url":"https://security.netapp.com/advisory/ntap-20191031-0005/"},{"name":"20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)","refsource":"BUGTRAQ","url":"https://seclists.org/bugtraq/2019/Nov/11"},{"name":"http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"},{"name":"USN-4186-1","refsource":"UBUNTU","url":"https://usn.ubuntu.com/4186-1/"},{"name":"[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html"},{"name":"http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html"},{"name":"[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://source.android.com/security/bulletin/2019-10-01","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2019/Oct/38","name":"20191018 CVE 2019-2215 Android Binder Use After Free","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20191031-0005/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Nov/11","name":"20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://usn.ubuntu.com/4186-1/","name":"USN-4186-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html","name":"[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html","name":"[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T18:42:50.933Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2019-2215","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-07T13:04:20.328785Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:45:29.242Z"},"timeline":[{"time":"2021-11-03T00:00:00.000Z","lang":"en","value":"CVE-2019-2215 added to CISA KEV"}]}]}}}