CVE-2019-2215

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 72,1%

Kerentanan Use After Free pada google android, debian linux +51 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Rincian

Terbit di NVD

11 Oktober 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

72,1% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Android Kernel Use-After-Free Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 84 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://source.android.com/security/bulletin/2019-10-01 advisory vendor
• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html patch · advisory pihak ketiga · vdb entry
• https://seclists.org/bugtraq/2019/Nov/11 mailing list · patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215 pemerintah AS
• http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2019/Oct/38 mailing list · advisory pihak ketiga
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20191031-0005/ advisory pihak ketiga
• https://usn.ubuntu.com/4186-1/ advisory pihak ketiga