WaratekVRT Sign in

CVE-2019-2215

Affected software6 products, listed below
Severity7.8 High CVSS 3.1 3 scores
WeaknessUse after free (CWE-416)
Published11 Oct 2019
Updated17 Jun 2026

Description

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 7 citations · 36 exploits · earliest 2019-09-26.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 38 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit; first seen 2019-10-04.
  • EPSS 72% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-2215 in VulnCheck (free account), which lists 2 more citations and 31 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation bugs.chromium.org /p/project-zero/issues/detail?id=1942 2019-09-26
Reported exploitation docs.google.com /spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit 2019-09-26
Reported exploitation trendmicro.com /en_us/research/20/a/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group.html 2020-01-06
Reported exploitation trendmicro.com /en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html 2020-12-09
Reported exploitation lookout.com /threat-intelligence/article/lookout-discovers-global-rooting-malware-campaign 2021-10-28
Exploit reference VulnCheck XDB efc0233357b1 Exploit type: local 2019-10-04
Exploit reference VulnCheck XDB 034793af86bc Exploit type: local 2019-10-14
Exploit reference VulnCheck XDB 8042323a8edc Exploit type: local 2019-11-24
Exploit reference VulnCheck XDB 703d7ebd8c6a Exploit type: local 2020-01-30
Exploit reference VulnCheck XDB bb9d6564de2b Exploit type: local 2020-02-17
IndexArtifactStarsFirst seen
GitHub PoC Temproot for Pixel 2 and Pixel 2 XL via CVE-2019-2215 138 2019-10-14
Exploit-DB Android Binder - Use-After-Free (Metasploit) 2020-02-24
Metasploit Android Binder Use-After-Free Exploit (excellent rank)
GitHub PoC timwr/CVE-2019-2215 79 2019-10-04
Exploit-DB Android Binder - Use-After-Free (Metasploit) 2020-02-24
GitHub PoC Triggering and Analyzing Android Kernel Vulnerability CVE-2019-2215 73 2020-06-07
Exploit-DB Android - Binder Driver Use-After-Free 2019-10-04
GitHub PoC This lab guides you through setting up an environment to explore CVE-2019-2215, a critical Android kernel vulnerability in the binder subsystem. 46 2025-03-13
GitHub PoC Android privilege escalation via an use-after-free in binder.c 41 2020-02-17
GitHub PoC Temproot for Bravia TV via CVE-2019-2215. 26 2020-01-30

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.8 HIGH v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 4.6 none AV:L/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

77 products, 84 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 16.04
nvd debian debian linux generic 8.0
nvd google android generic any version
nvd huawei alp-al00b firmware generic ＜ 10.0.0.162.0.156
nvd huawei alp-tl00b firmware generic ＜ 10.0.0.162.1.156
nvd huawei anne-al00 firmware generic ＜ 9.1.0.126.0.126
nvd huawei ares-al00b firmware generic ＜ 9.1.0.165.0.165
nvd huawei ares-al10d firmware generic ＜ 9.1.0.165.0.165
nvd huawei ares-tl00chw firmware generic ＜ 8.2.0.163.1.2
nvd huawei barca-al00 firmware generic ＜ 8.0.0.377.0
nvd huawei berkeley-l09 firmware generic ＜ 9.1.0.351.432.5
nvd huawei berkeley-tl10 firmware generic ＜ 9.1.0.333.1.333
nvd huawei bla-al00b firmware generic ＜ 10.0.0.170.786.170
nvd huawei bla-l29c firmware generic ＜ 9.1.0.300.432.4
nvd huawei bla-tl00b firmware generic ＜ 10.0.0.170.1.170
nvd huawei columbia-al00a firmware generic ＜ 8.1.0.186.0
nvd huawei columbia-l29d firmware generic ＜ 9.1.0.325.432.4
nvd huawei cornell-tl10b firmware generic ＜ 9.1.0.321.1.320
nvd huawei duke-l09i firmware generic ＜ 9.0.1.171.675.6
nvd huawei dura-al00a firmware generic ＜ 1.0.0.190.0
nvd huawei figo-al00a firmware generic ＜ 9.1.0.130.0.115
nvd huawei florida-al20b firmware generic ＜ 9.1.0.128.0.112
nvd huawei florida-l03 firmware generic ＜ 9.1.0.154.605.7
nvd huawei florida-l21 firmware generic ＜ 9.1.0.154.605.7
nvd huawei florida-l22 firmware generic ＜ 9.1.0.150.636.6
nvd huawei florida-tl10b firmware generic ＜ 9.1.0.128.1.112
nvd huawei honor 9i firmware generic ＜ 9.1.0.130.0.112
nvd huawei honor view 20 firmware generic ＜ 10.1.0.214.10.5
nvd huawei jakarta-al00a firmware generic ＜ 9.1.0.260.0.120
nvd huawei johnson-tl00d firmware generic ＜ 9.1.0.219.1.18
nvd huawei leland-al10b firmware generic ＜ 9.1.0.130.0.112
nvd huawei leland-l21a firmware generic ＜ 9.1.0.156.185.5
nvd huawei leland-l32a firmware generic ＜ 9.1.0.153.675.6
nvd huawei leland-tl10b firmware generic ＜ 9.1.0.130.1.112
nvd huawei leland-tl10c firmware generic ＜ 9.1.0.130.1.112
nvd huawei lelandp-al00c firmware generic ＜ 9.1.0.130.0.112
nvd huawei lelandp-l22c firmware generic ＜ 9.1.0.156.636.5
nvd huawei mate rs firmware generic 9.1.0.321\(c786e320r1p1t8\)
nvd huawei neo-al00d firmware generic ＜ 9.1.0.321.786.320
nvd huawei nova 2s firmware generic ＜ 9.1.0.210.1.110
nvd huawei nova 3 firmware generic ＜ 9.1.0.351.0.351
nvd huawei nova 3e firmware generic ＜ 9.1.0.200.636.4 · ＜ 9.1.0.201.185.4 · ＜ 9.1.0.201.636.4
nvd huawei p20 firmware generic ＜ 9.1.0.312.0.312
nvd huawei p20 lite firmware generic ＜ 9.1.0.200.605.4 · ＜ 9.1.0.200.635.5 · ＜ 9.1.0.200.636.4 · ＜ 9.1.0.201.185.4 · ＜ 9.1.0.201.636.4 · ＜ 9.1.0.246.432.6
nvd huawei princeton-al10b firmware generic ＜ 10.1.0.160.0.160
nvd huawei rhone-al00 firmware generic ＜ 8.0.0.376.0
nvd huawei stanford-l09 firmware generic ＜ 9.1.0.211.635.2
nvd huawei stanford-l09s firmware generic ＜ 9.1.0.210.432.2
nvd huawei sydney-al00 firmware generic ＜ 9.1.0.212.0.62
nvd huawei sydney-tl00 firmware generic ＜ 9.1.0.212.1.62
nvd huawei sydneym-al00 firmware generic ＜ 9.1.0.212.0.62
nvd huawei tony-al00b firmware generic ＜ 10.0.0.175.0.59
nvd huawei tony-tl00b firmware generic ＜ 10.0.0.175.1.59
nvd huawei y9 2019 firmware generic ＜ 9.1.0.297.605.4
nvd huawei yale-al00a firmware generic ＜ 10.1.0.160.0.160
nvd huawei yale-l21a firmware generic ＜ 10.1.0.231.10.3
nvd huawei yale-tl00b firmware generic ＜ 10.1.0.160.1.160
nvd netapp a220 firmware generic any version
nvd netapp a320 firmware generic any version
nvd netapp a800 firmware generic any version
nvd netapp aff baseboard management controller firmware generic any version
nvd netapp c190 firmware generic any version
nvd netapp cloud backup generic any version
nvd netapp data availability services generic any version
nvd netapp fas2720 firmware generic any version
nvd netapp fas2750 firmware generic any version
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h610s firmware generic any version
nvd netapp h700s firmware generic any version
nvd netapp hci management node generic any version
nvd netapp service processor generic any version
nvd netapp solidfire generic any version
nvd netapp solidfire baseboard management controller firmware generic any version
nvd netapp steelstore cloud integrated storage generic any version

References

URLTags
http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html Patch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/38 Mailing List, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/11 Mailing List, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191031-0005/ Third Party Advisory
https://source.android.com/security/bulletin/2019-10-01 Vendor Advisory

Timeline
VulnCheck KEV: earliest evidence2019-09-26Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2019-10-11By the CVE Program.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.