What’s Vulnerable › Vulnerabilities

CVE-2019-2215: Android Kernel Use-After-Free Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 72.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-11 · updated 2026-06-17
• Weakness: CWE-416

Description

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Affected products

• Canonical Ubuntu Linux: 16.04
• Debian Linux: 8.0
• Android: all versions
• Huawei Alp-Al00B Firmware: before 10.0.0.162\(c00e156r2p4\) — fixed in 10.0.0.162\(c00e156r2p4\)
• Huawei Alp-Tl00B Firmware: before 10.0.0.162\(c01e156r1p4\) — fixed in 10.0.0.162\(c01e156r1p4\)
• Huawei Technologies Co., Ltd. Anne-AL00: before 9.1.0.126\(c00e126r1p7t8\) — fixed in 9.1.0.126\(c00e126r1p7t8\)
• Huawei Ares-Al00B Firmware: before 9.1.0.165\(c00e165r2p5t8\) — fixed in 9.1.0.165\(c00e165r2p5t8\)
• Huawei Ares-Al10D Firmware: before 9.1.0.165\(c00e165r2p5t8\) — fixed in 9.1.0.165\(c00e165r2p5t8\)
• Huawei Ares-Tl00Chw Firmware: before 8.2.0.163\(c01r2p1\) — fixed in 8.2.0.163\(c01r2p1\)
• Huawei Barca-Al00 Firmware: before 8.0.0.377\(c00\) — fixed in 8.0.0.377\(c00\)
• Huawei Berkeley-L09 Firmware: before 9.1.0.351\(c432e5r1p13t8\) — fixed in 9.1.0.351\(c432e5r1p13t8\)
• Huawei Berkeley-Tl10 Firmware: before 9.1.0.333\(c01e333r1p1t8\) — fixed in 9.1.0.333\(c01e333r1p1t8\)
• Huawei Bla-Al00B Firmware: before 10.0.0.170\(c786e170r2p4\) — fixed in 10.0.0.170\(c786e170r2p4\)
• Huawei Bla-L29C Firmware: before 9.1.0.300\(c432e4r1p11t8\) — fixed in 9.1.0.300\(c432e4r1p11t8\)
• Huawei Bla-Tl00B Firmware: before 10.0.0.170\(c01e170r1p4\) — fixed in 10.0.0.170\(c01e170r1p4\)
• Huawei Columbia-Al00A Firmware: before 8.1.0.186\(c00gt\) — fixed in 8.1.0.186\(c00gt\)
• Huawei Columbia-L29D Firmware: before 9.1.0.325\(c432e4r1p12t8\) — fixed in 9.1.0.325\(c432e4r1p12t8\)
• Huawei Cornell-Tl10B Firmware: before 9.1.0.321\(c01e320r1p1t8\) — fixed in 9.1.0.321\(c01e320r1p1t8\)
• Huawei Duke-L09I Firmware: before 9.0.1.171\(c675e6r1p5t8\) — fixed in 9.0.1.171\(c675e6r1p5t8\)
• Huawei Dura-Al00A Firmware: before 1.0.0.190\(c00\) — fixed in 1.0.0.190\(c00\)
• Huawei Figo-Al00A Firmware: before 9.1.0.130\(c00e115r2p8t8\) — fixed in 9.1.0.130\(c00e115r2p8t8\)
• Huawei Florida-Al20B Firmware: before 9.1.0.128\(c00e112r1p6t8\) — fixed in 9.1.0.128\(c00e112r1p6t8\)
• Huawei Florida-L03 Firmware: before 9.1.0.154\(c605e7r1p2t8\) — fixed in 9.1.0.154\(c605e7r1p2t8\)
• Huawei Florida-L21 Firmware: before 9.1.0.154\(c605e7r1p2t8\) — fixed in 9.1.0.154\(c605e7r1p2t8\)
• Huawei Florida-L22 Firmware: before 9.1.0.150\(c636e6r1p5t8\) — fixed in 9.1.0.150\(c636e6r1p5t8\)
• Huawei Florida-Tl10B Firmware: before 9.1.0.128\(c01e112r1p6t8\) — fixed in 9.1.0.128\(c01e112r1p6t8\)
• Huawei Honor 9I Firmware: before 9.1.0.130\(c00e112r2p10t8\) — fixed in 9.1.0.130\(c00e112r2p10t8\)
• Huawei Honor View 20 Firmware: before 10.1.0.214\(c10e5r4p3\) — fixed in 10.1.0.214\(c10e5r4p3\)
• Huawei Jakarta-Al00A Firmware: before 9.1.0.260\(c00e120r2p2\) — fixed in 9.1.0.260\(c00e120r2p2\)
• Huawei Johnson-Tl00D Firmware: before 9.1.0.219\(c01e18r3p2t8\) — fixed in 9.1.0.219\(c01e18r3p2t8\)

How to fix

Upgrade to a fixed version: Huawei Alp-Al00B Firmware 10.0.0.162\(c00e156r2p4\); Huawei Alp-Tl00B Firmware 10.0.0.162\(c01e156r1p4\); Huawei Technologies Co., Ltd. Anne-AL00 9.1.0.126\(c00e126r1p7t8\); Huawei Ares-Al00B Firmware 9.1.0.165\(c00e165r2p5t8\); Huawei Ares-Al10D Firmware 9.1.0.165\(c00e165r2p5t8\); Huawei Ares-Tl00Chw Firmware 8.2.0.163\(c01r2p1\); Huawei Barca-Al00 Firmware 8.0.0.377\(c00\); Huawei Berkeley-L09 Firmware 9.1.0.351\(c432e5r1p13t8\); Huawei Berkeley-Tl10 Firmware 9.1.0.333\(c01e333r1p1t8\); Huawei Bla-Al00B Firmware 10.0.0.170\(c786e170r2p4\); Huawei Bla-L29C Firmware 9.1.0.300\(c432e4r1p11t8\); Huawei Bla-Tl00B Firmware 10.0.0.170\(c01e170r1p4\). Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html
• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
• http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html
• http://seclists.org/fulldisclosure/2019/Oct/38
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en
• https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
• https://seclists.org/bugtraq/2019/Nov/11
• https://security.netapp.com/advisory/ntap-20191031-0005/
• https://source.android.com/security/bulletin/2019-10-01
• https://usn.ubuntu.com/4186-1/
• http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html

Get alerted when CVE-2019-2215 or the next vulnerability affects your stack