CVE-2019-2215

Published: Oct 11, 2019Modified: Jun 17, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Affected (84)

Products: Google: Android · Debian: Debian Linux · Canonical: Ubuntu Linux · +2 more

Show all products

Google: Android · Debian: Debian Linux · Canonical: Ubuntu Linux · Netapp: Cloud Backup, Data Availability Services, Hci Management Node, Service Processor, Solidfire, Steelstore Cloud Integrated Storage, Solidfire Baseboard Management Controller Firmware, Aff Baseboard Management Controller Firmware, A320 Firmware, C190 Firmware, A220 Firmware, Fas2720 Firmware, Fas2750 Firmware, A800 Firmware, H300s Firmware, H500s Firmware, H700s Firmware, H410s Firmware, H410c Firmware, H610s Firmware · Huawei: Alp Al00b Firmware, Alp Tl00b Firmware, Anne Al00 Firmware, Ares Al00b Firmware, Ares Al10d Firmware, Ares Tl00chw Firmware, Bla Al00b Firmware, Bla L29c Firmware, Bla Tl00b Firmware, Barca Al00 Firmware, Berkeley L09 Firmware, Berkeley Tl10 Firmware, Columbia Al00a Firmware, Columbia L29d Firmware, Cornell Tl10b Firmware, Duke L09i Firmware, Dura Al00a Firmware, Figo Al00a Firmware, Florida Al20b Firmware, Florida L03 Firmware, Florida L21 Firmware, Florida L22 Firmware, Florida Tl10b Firmware, Mate Rs Firmware, P20 Firmware, P20 Lite Firmware, Y9 2019 Firmware, Nova 2s Firmware, Nova 3 Firmware, Nova 3e Firmware, Honor View 20 Firmware, Jakarta Al00a Firmware, Johnson Tl00d Firmware, Leland Al10b Firmware, Leland L21a Firmware, Leland L32a Firmware, Leland Tl10b Firmware, Leland Tl10c Firmware, Lelandp Al00c Firmware, Lelandp L22c Firmware, Neo Al00d Firmware, Princeton Al10b Firmware, Rhone Al00 Firmware, Stanford L09 Firmware, Stanford L09s Firmware, Sydney Al00 Firmware, Sydney Tl00 Firmware, Sydneym Al00 Firmware, Tony Al00b Firmware, Tony Tl00b Firmware, Yale Al00a Firmware, Yale L21a Firmware, Yale Tl00b Firmware, Honor 9i Firmware

1 product

1 product

1 product

20 products

Data Availability Services

Hci Management Node

Service Processor

Solidfire

Steelstore Cloud Integrated Storage

Solidfire Baseboard Management Controller Firmware

Aff Baseboard Management Controller Firmware

54 products

Ares Tl00chw Firmware

Berkeley L09 Firmware

Berkeley Tl10 Firmware

Columbia Al00a Firmware

Columbia L29d Firmware

Cornell Tl10b Firmware

Duke L09i Firmware

Dura Al00a Firmware

Figo Al00a Firmware

Florida Al20b Firmware

Florida L03 Firmware

Florida L21 Firmware

Florida L22 Firmware

Florida Tl10b Firmware

Honor View 20 Firmware

Jakarta Al00a Firmware

Johnson Tl00d Firmware

Leland Al10b Firmware

Leland L21a Firmware

Leland L32a Firmware

Leland Tl10b Firmware

Leland Tl10c Firmware

Lelandp Al00c Firmware

Lelandp L22c Firmware

Neo Al00d Firmware

Princeton Al10b Firmware

Rhone Al00 Firmware

Stanford L09 Firmware

Stanford L09s Firmware

Sydney Al00 Firmware

Sydney Tl00 Firmware

Sydneym Al00 Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Android	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04

Configuration D

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Data Availability Services	All versions
Netapp Hci Management Node	All versions
Netapp Service Processor	All versions
Netapp Solidfire	All versions
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Solidfire Baseboard Management Controller Firmware	All versions

Running on/with	Platform Versions
Netapp Solidfire Baseboard Management Controller	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff Baseboard Management Controller Firmware	All versions

Running on/with	Platform Versions
Netapp Aff Baseboard Management Controller	Version a700s

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A320 Firmware	All versions

Running on/with	Platform Versions
Netapp A320	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C190 Firmware	All versions

Running on/with	Platform Versions
Netapp C190	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A220 Firmware	All versions

Running on/with	Platform Versions
Netapp A220	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2720 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2720	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2750 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2750	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A800 Firmware	All versions

Running on/with	Platform Versions
Netapp A800	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Alp Al00b Firmware	Before 10.0.0.162\(c00e156r2p4\)

Running on/with	Platform Versions
Huawei Alp Al00b	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Alp Tl00b Firmware	Before 10.0.0.162\(c01e156r1p4\)

Running on/with	Platform Versions
Huawei Alp Tl00b	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Anne Al00 Firmware	Before 9.1.0.126\(c00e126r1p7t8\)

Running on/with	Platform Versions
Huawei Anne Al00	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ares Al00b Firmware	Before 9.1.0.165\(c00e165r2p5t8\)

Running on/with	Platform Versions
Huawei Ares Al00b	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ares Al10d Firmware	Before 9.1.0.165\(c00e165r2p5t8\)

Running on/with	Platform Versions
Huawei Ares Al10d	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ares Tl00chw Firmware	Before 8.2.0.163\(c01r2p1\)

Running on/with	Platform Versions
Huawei Ares Tl00chw	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Bla Al00b Firmware	Before 10.0.0.170\(c786e170r2p4\)

Running on/with	Platform Versions
Huawei Bla Al00b	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Bla L29c Firmware	Before 9.1.0.300\(c432e4r1p11t8\)

Running on/with	Platform Versions
Huawei Bla L29c	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Bla Tl00b Firmware	Before 10.0.0.170\(c01e170r1p4\)

Running on/with	Platform Versions
Huawei Bla Tl00b	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Barca Al00 Firmware	Before 8.0.0.377\(c00\)

Running on/with	Platform Versions
Huawei Barca Al00	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berkeley L09 Firmware	Before 9.1.0.351\(c432e5r1p13t8\)

Running on/with	Platform Versions
Huawei Berkeley L09	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Berkeley Tl10 Firmware	Before 9.1.0.333\(c01e333r1p1t8\)

Running on/with	Platform Versions
Huawei Berkeley Tl10	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Columbia Al00a Firmware	Before 8.1.0.186\(c00gt\)

Running on/with	Platform Versions
Huawei Columbia Al00a	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Columbia L29d Firmware	Before 9.1.0.325\(c432e4r1p12t8\)

Running on/with	Platform Versions
Huawei Columbia L29d	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Cornell Tl10b Firmware	Before 9.1.0.321\(c01e320r1p1t8\)

Running on/with	Platform Versions
Huawei Cornell Tl10b	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Duke L09i Firmware	Before 9.0.1.171\(c675e6r1p5t8\)

Running on/with	Platform Versions
Huawei Duke L09i	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Dura Al00a Firmware	Before 1.0.0.190\(c00\)

Running on/with	Platform Versions
Huawei Dura Al00a	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Figo Al00a Firmware	Before 9.1.0.130\(c00e115r2p8t8\)

Running on/with	Platform Versions
Huawei Figo Al00a	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Florida Al20b Firmware	Before 9.1.0.128\(c00e112r1p6t8\)

Running on/with	Platform Versions
Huawei Florida Al20b	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Florida L03 Firmware	Before 9.1.0.154\(c605e7r1p2t8\)

Running on/with	Platform Versions
Huawei Florida L03	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Florida L21 Firmware	Before 9.1.0.154\(c605e7r1p2t8\)

Running on/with	Platform Versions
Huawei Florida L21	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Florida L22 Firmware	Before 9.1.0.150\(c636e6r1p5t8\)

Running on/with	Platform Versions
Huawei Florida L22	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Florida Tl10b Firmware	Before 9.1.0.128\(c01e112r1p6t8\)

Running on/with	Platform Versions
Huawei Florida Tl10b	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Mate Rs Firmware	Version 9.1.0.321(c786e320r1p1t8)

Running on/with	Platform Versions
Huawei Mate Rs	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei P20 Firmware	Before 9.1.0.312\(c00e312r1p1t8\)

Running on/with	Platform Versions
Huawei P20	All versions

Configuration R

1 vulnerable

Vulnerable Software	Affected Versions
Huawei P20 Lite Firmware	Before 9.1.0.200\(c605e4r1p3t8\)

Configuration S

1 vulnerable

Vulnerable Software	Affected Versions
Huawei P20 Lite Firmware	Before 9.1.0.200\(c635e5r1p1t8\)

Configuration T

1 vulnerable

Vulnerable Software	Affected Versions
Huawei P20 Lite Firmware	Before 9.1.0.246\(c432e6r1p7t8\)

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Y9 2019 Firmware	Before 9.1.0.297\(c605e4r1p1t8\)

Running on/with	Platform Versions
Huawei Y9 2019	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Nova 2s Firmware	Before 9.1.0.210\(c01e110r1p9t8\)

Running on/with	Platform Versions
Huawei Nova 2s	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Nova 3 Firmware	Before 9.1.0.351\(c00e351r1p1t8\)

Running on/with	Platform Versions
Huawei Nova 3	All versions

Configuration X

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Nova 3e Firmware	Before 9.1.0.200\(c636e4r1p5t8\)

Configuration Y

1 vulnerable

Vulnerable Software	Affected Versions
Huawei P20 Lite Firmware	Before 9.1.0.200\(c636e4r1p5t8\)

Configuration Z

1 vulnerable

Vulnerable Software	Affected Versions
Huawei P20 Lite Firmware	Before 9.1.0.201\(c636e4r1p5t8\)

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Huawei Nova 3e Firmware	Before 9.1.0.201\(c636e4r1p5t8\)

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Nova 3e Firmware	Before 9.1.0.201\(zafc185e4r1p8t8\)

Running on/with	Platform Versions
Huawei Nova 3e	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei P20 Lite Firmware	Before 9.1.0.201\(zafc185e4r1p8t8\)

Running on/with	Platform Versions
Huawei P20 Lite	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Honor View 20 Firmware	Before 10.1.0.214\(c10e5r4p3\)

Running on/with	Platform Versions
Huawei Honor View 20	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Jakarta Al00a Firmware	Before 9.1.0.260\(c00e120r2p2\)

Running on/with	Platform Versions
Huawei Jakarta Al00a	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Johnson Tl00d Firmware	Before 9.1.0.219\(c01e18r3p2t8\)

Running on/with	Platform Versions
Huawei Johnson Tl00d	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Leland Al10b Firmware	Before 9.1.0.130\(c00e112r2p10t8\)

Running on/with	Platform Versions
Huawei Leland Al10b	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Leland L21a Firmware	Before 9.1.0.156\(c185e5r1p5t8\)

Running on/with	Platform Versions
Huawei Leland L21a	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Leland L32a Firmware	Before 9.1.0.153\(c675e6r1p4t8\)

Running on/with	Platform Versions
Huawei Leland L32a	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Leland Tl10b Firmware	Before 9.1.0.130\(c01e112r2p10t8\)

Running on/with	Platform Versions
Huawei Leland Tl10b	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Leland Tl10c Firmware	Before 9.1.0.130\(c01e112r2p10t8\)

Running on/with	Platform Versions
Huawei Leland Tl10c	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Lelandp Al00c Firmware	Before 9.1.0.130\(c00e112r2p10t8\)

Running on/with	Platform Versions
Huawei Lelandp Al00c	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Lelandp L22c Firmware	Before 9.1.0.156\(c636e5r1p5t8\)

Running on/with	Platform Versions
Huawei Lelandp L22c	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Neo Al00d Firmware	Before 9.1.0.321\(c786e320r1p1t8\)

Running on/with	Platform Versions
Huawei Neo Al00d	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Princeton Al10b Firmware	Before 10.1.0.160\(c00e160r2p11\)

Running on/with	Platform Versions
Huawei Princeton Al10b	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Rhone Al00 Firmware	Before 8.0.0.376\(c00\)

Running on/with	Platform Versions
Huawei Rhone Al00	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Stanford L09 Firmware	Before 9.1.0.211\(c635e2r1p4t8\)

Running on/with	Platform Versions
Huawei Stanford L09	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Stanford L09s Firmware	Before 9.1.0.210\(c432e2r1p5t8\)

Running on/with	Platform Versions
Huawei Stanford L09s	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Sydney Al00 Firmware	Before 9.1.0.212\(c00e62r1p7t8\)

Running on/with	Platform Versions
Huawei Sydney Al00	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Sydney Tl00 Firmware	Before 9.1.0.212\(c01e62r1p7t8\)

Running on/with	Platform Versions
Huawei Sydney Tl00	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Sydneym Al00 Firmware	Before 9.1.0.212\(c00e62r1p7t8\)

Running on/with	Platform Versions
Huawei Sydneym Al00	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Tony Al00b Firmware	Before 10.0.0.175\(c00e59r2p11\)

Running on/with	Platform Versions
Huawei Tony Al00b	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Tony Tl00b Firmware	Before 10.0.0.175\(c01e59r2p11\)

Running on/with	Platform Versions
Huawei Tony Tl00b	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Yale Al00a Firmware	Before 10.1.0.160\(c00e160r8p12\)

Running on/with	Platform Versions
Huawei Yale Al00a	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Yale L21a Firmware	Before 10.1.0.231\(c10e3r3p2\)

Running on/with	Platform Versions
Huawei Yale L21a	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Yale Tl00b Firmware	Before 10.1.0.160\(c01e160r8p12\)

Running on/with	Platform Versions
Huawei Yale Tl00b	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Honor 9i Firmware	Before 9.1.0.130\(c00e112r2p10t8\)

Running on/with	Platform Versions
Huawei Honor 9i	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (23)

http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html

Source: security@android.com

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Source: security@android.com

PatchThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html

Source: security@android.com

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2019/Oct/38

Source: security@android.com

Mailing ListThird Party Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en

Source: security@android.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html

Source: security@android.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

Source: security@android.com

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Nov/11

Source: security@android.com

Mailing ListPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20191031-0005/

Source: security@android.com

Third Party Advisory

https://source.android.com/security/bulletin/2019-10-01

Source: security@android.com

Vendor Advisory

https://usn.ubuntu.com/4186-1/

Source: security@android.com

Third Party Advisory

http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html