CVE-2019-2215
- State
- Published
- Severity
- 7.8 High
- Published
- Oct 11, 2019
- Updated
- Oct 21, 2025
- Reserved
- Dec 10, 2018
Description
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
Androidn/a |
|
References
- https://source.android.com/security/bulletin/2019-10-01
- 20191018 CVE 2019-2215 Android Binder Use After Freemailing-list
- http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en
- https://security.netapp.com/advisory/ntap-20191031-0005/
- 20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)mailing-list
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- USN-4186-1vendor-advisory
- [debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security updatemailing-list
- http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html
- [debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security updatemailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.