IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.8Yüksek KEV

CVE-2019-2215Android Kernel Use-After-Free Vulnerability

Android Yayım: (7 yıl önce)

Aktif olarak istismar ediliyor — Android Kernel Use-After-Free Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.11.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.05.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-2215

Açıklama

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Zayıflık türü (CWE): CWE-416

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
canonical ubuntu linux 16.04
debian debian linux 8.0
google android —
huawei alp-al00b firmware < 10.0.0.162\(c00e156r2p4\)
huawei alp-tl00b firmware < 10.0.0.162\(c01e156r1p4\)
huawei anne-al00 firmware < 9.1.0.126\(c00e126r1p7t8\)
huawei ares-al00b firmware < 9.1.0.165\(c00e165r2p5t8\)
huawei ares-al10d firmware < 9.1.0.165\(c00e165r2p5t8\)
huawei ares-tl00chw firmware < 8.2.0.163\(c01r2p1\)
huawei barca-al00 firmware < 8.0.0.377\(c00\)
huawei berkeley-l09 firmware < 9.1.0.351\(c432e5r1p13t8\)
huawei berkeley-tl10 firmware < 9.1.0.333\(c01e333r1p1t8\)
huawei bla-al00b firmware < 10.0.0.170\(c786e170r2p4\)
huawei bla-l29c firmware < 9.1.0.300\(c432e4r1p11t8\)
huawei bla-tl00b firmware < 10.0.0.170\(c01e170r1p4\)
huawei columbia-al00a firmware < 8.1.0.186\(c00gt\)
huawei columbia-l29d firmware < 9.1.0.325\(c432e4r1p12t8\)
huawei cornell-tl10b firmware < 9.1.0.321\(c01e320r1p1t8\)
huawei duke-l09i firmware < 9.0.1.171\(c675e6r1p5t8\)
huawei dura-al00a firmware < 1.0.0.190\(c00\)
huawei figo-al00a firmware < 9.1.0.130\(c00e115r2p8t8\)
huawei florida-al20b firmware < 9.1.0.128\(c00e112r1p6t8\)
huawei florida-l03 firmware < 9.1.0.154\(c605e7r1p2t8\)
huawei florida-l21 firmware < 9.1.0.154\(c605e7r1p2t8\)
huawei florida-l22 firmware < 9.1.0.150\(c636e6r1p5t8\)
huawei florida-tl10b firmware < 9.1.0.128\(c01e112r1p6t8\)
huawei honor 9i firmware < 9.1.0.130\(c00e112r2p10t8\)
huawei honor view 20 firmware < 10.1.0.214\(c10e5r4p3\)
huawei jakarta-al00a firmware < 9.1.0.260\(c00e120r2p2\)
huawei johnson-tl00d firmware < 9.1.0.219\(c01e18r3p2t8\)
huawei leland-al10b firmware < 9.1.0.130\(c00e112r2p10t8\)
huawei leland-l21a firmware < 9.1.0.156\(c185e5r1p5t8\)
huawei leland-l32a firmware < 9.1.0.153\(c675e6r1p4t8\)
huawei leland-tl10b firmware < 9.1.0.130\(c01e112r2p10t8\)
huawei leland-tl10c firmware < 9.1.0.130\(c01e112r2p10t8\)
huawei lelandp-al00c firmware < 9.1.0.130\(c00e112r2p10t8\)
huawei lelandp-l22c firmware < 9.1.0.156\(c636e5r1p5t8\)
huawei mate rs firmware 9.1.0.321(c786e320r1p1t8)
huawei neo-al00d firmware < 9.1.0.321\(c786e320r1p1t8\)
huawei nova 2s firmware < 9.1.0.210\(c01e110r1p9t8\)
huawei nova 3 firmware < 9.1.0.351\(c00e351r1p1t8\)
huawei nova 3e firmware < 9.1.0.200\(c636e4r1p5t8\)
huawei p20 firmware < 9.1.0.312\(c00e312r1p1t8\)
huawei p20 lite firmware < 9.1.0.200\(c605e4r1p3t8\)
huawei princeton-al10b firmware < 10.1.0.160\(c00e160r2p11\)
huawei rhone-al00 firmware < 8.0.0.376\(c00\)
huawei stanford-l09 firmware < 9.1.0.211\(c635e2r1p4t8\)
huawei stanford-l09s firmware < 9.1.0.210\(c432e2r1p5t8\)
huawei sydney-al00 firmware < 9.1.0.212\(c00e62r1p7t8\)
huawei sydney-tl00 firmware < 9.1.0.212\(c01e62r1p7t8\)
huawei sydneym-al00 firmware < 9.1.0.212\(c00e62r1p7t8\)
huawei tony-al00b firmware < 10.0.0.175\(c00e59r2p11\)
huawei tony-tl00b firmware < 10.0.0.175\(c01e59r2p11\)
huawei y9 2019 firmware < 9.1.0.297\(c605e4r1p1t8\)
huawei yale-al00a firmware < 10.1.0.160\(c00e160r8p12\)
huawei yale-l21a firmware < 10.1.0.231\(c10e3r3p2\)
huawei yale-tl00b firmware < 10.1.0.160\(c01e160r8p12\)
netapp a220 firmware —
netapp a320 firmware —
netapp a800 firmware —
netapp aff baseboard management controller firmware —
netapp c190 firmware —
netapp cloud backup —
netapp data availability services —
netapp fas2720 firmware —
netapp fas2750 firmware —
netapp h300s firmware —
netapp h410c firmware —
netapp h410s firmware —
netapp h500s firmware —
netapp h610s firmware —
netapp h700s firmware —
netapp hci management node —
netapp service processor —
netapp solidfire —
netapp solidfire baseboard management controller firmware —
netapp steelstore cloud integrated storage —
— Android Kernel

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (60)
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:huawei:alp-al00b_firmware:*:*:*:*:*:*:*:* < 10.0.0.162\(c00e156r2p4\)
  • cpe:2.3:o:huawei:alp-tl00b_firmware:*:*:*:*:*:*:*:* < 10.0.0.162\(c01e156r1p4\)
  • cpe:2.3:o:huawei:anne-al00_firmware:*:*:*:*:*:*:*:* < 9.1.0.126\(c00e126r1p7t8\)
  • cpe:2.3:o:huawei:ares-al00b_firmware:*:*:*:*:*:*:*:* < 9.1.0.165\(c00e165r2p5t8\)
  • cpe:2.3:o:huawei:ares-al10d_firmware:*:*:*:*:*:*:*:* < 9.1.0.165\(c00e165r2p5t8\)
  • cpe:2.3:o:huawei:ares-tl00chw_firmware:*:*:*:*:*:*:*:* < 8.2.0.163\(c01r2p1\)
  • cpe:2.3:o:huawei:bla-al00b_firmware:*:*:*:*:*:*:*:* < 10.0.0.170\(c786e170r2p4\)
  • cpe:2.3:o:huawei:bla-l29c_firmware:*:*:*:*:*:*:*:* < 9.1.0.300\(c432e4r1p11t8\)
  • cpe:2.3:o:huawei:bla-tl00b_firmware:*:*:*:*:*:*:*:* < 10.0.0.170\(c01e170r1p4\)
  • cpe:2.3:o:huawei:barca-al00_firmware:*:*:*:*:*:*:*:* < 8.0.0.377\(c00\)
  • cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:* < 9.1.0.351\(c432e5r1p13t8\)
  • cpe:2.3:o:huawei:berkeley-tl10_firmware:*:*:*:*:*:*:*:* < 9.1.0.333\(c01e333r1p1t8\)
  • cpe:2.3:o:huawei:columbia-al00a_firmware:*:*:*:*:*:*:*:* < 8.1.0.186\(c00gt\)
  • cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* < 9.1.0.325\(c432e4r1p12t8\)
  • cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:* < 9.1.0.321\(c01e320r1p1t8\)
  • cpe:2.3:o:huawei:duke-l09i_firmware:*:*:*:*:*:*:*:* < 9.0.1.171\(c675e6r1p5t8\)
  • cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:* < 1.0.0.190\(c00\)
  • cpe:2.3:o:huawei:figo-al00a_firmware:*:*:*:*:*:*:*:* < 9.1.0.130\(c00e115r2p8t8\)
  • cpe:2.3:o:huawei:florida-al20b_firmware:*:*:*:*:*:*:*:* < 9.1.0.128\(c00e112r1p6t8\)
  • cpe:2.3:o:huawei:florida-l03_firmware:*:*:*:*:*:*:*:* < 9.1.0.154\(c605e7r1p2t8\)
  • cpe:2.3:o:huawei:florida-l21_firmware:*:*:*:*:*:*:*:* < 9.1.0.154\(c605e7r1p2t8\)
  • cpe:2.3:o:huawei:florida-l22_firmware:*:*:*:*:*:*:*:* < 9.1.0.150\(c636e6r1p5t8\)
  • cpe:2.3:o:huawei:florida-tl10b_firmware:*:*:*:*:*:*:*:* < 9.1.0.128\(c01e112r1p6t8\)
  • cpe:2.3:o:huawei:mate_rs_firmware:9.1.0.321\(c786e320r1p1t8\):*:*:*:*:*:*:*
  • cpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:* < 9.1.0.312\(c00e312r1p1t8\)
  • cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:* < 9.1.0.200\(c605e4r1p3t8\)
  • cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:* < 9.1.0.200\(c635e5r1p1t8\)
  • cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:* < 9.1.0.246\(c432e6r1p7t8\)
  • cpe:2.3:o:huawei:y9_2019_firmware:*:*:*:*:*:*:*:* < 9.1.0.297\(c605e4r1p1t8\)
  • cpe:2.3:o:huawei:nova_2s_firmware:*:*:*:*:*:*:*:* < 9.1.0.210\(c01e110r1p9t8\)
  • cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:* < 9.1.0.351\(c00e351r1p1t8\)
  • cpe:2.3:o:huawei:nova_3e_firmware:*:*:*:*:*:*:*:* < 9.1.0.200\(c636e4r1p5t8\)
  • cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:* < 9.1.0.200\(c636e4r1p5t8\)
  • cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:* < 9.1.0.201\(c636e4r1p5t8\)
  • cpe:2.3:o:huawei:nova_3e_firmware:*:*:*:*:*:*:*:* < 9.1.0.201\(c636e4r1p5t8\)
  • cpe:2.3:o:huawei:nova_3e_firmware:*:*:*:*:*:*:*:* < 9.1.0.201\(zafc185e4r1p8t8\)
  • cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:* < 9.1.0.201\(zafc185e4r1p8t8\)

Aynı üründe son açıklar — Android

6.7Orta
CVE-2026-58977
Google Android

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

7.8Yüksek
CVE-2026-58930
Google Android

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, injec…

6.7Orta
CVE-2026-58927
Google Android

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a …

2.5Düşük
CVE-2026-58926
Google Android

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacke…

7.8Yüksek
CVE-2026-58925
Google Android

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigg…

7.5Yüksek
CVE-2026-58924
Google Android

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within th…