Your submission was sent successfully! Close

CVE-2019-2215

Published: 11 October 2019

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

From the Ubuntu security team

Maddie Stone discovered that the Binder IPC Driver implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

AuthorNote
sbeattie
from the project zero report: enabling CONFIG_DEBUG_LIST breaks the
primitive.
Priority

Medium

CVSS 3 base score: 7.8

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-10.11)
disco Not vulnerable
(4.18.0-10.11)
eoan Not vulnerable
(5.0.0-13.14)
precise Ignored
(was needs-triage ESM criteria)
trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (4.16~rc1)
xenial
Released (4.4.0-168.197)
Patches:
Introduced by

457b9a6f09f011ebcb9b52cc203a6331a6fc2de7

Fixed by f5cb779ba16334b45ba8946d6bfa6d9834d1527f
linux-aws
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1001.1)
disco Not vulnerable
(4.18.0-1002.3)
eoan Not vulnerable
(5.0.0-1004.4)
precise Does not exist

trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (4.16~rc1)
xenial
Released (4.4.0-1098.109)
linux-aws-5.0
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1021.24~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-aws-hwe
Launchpad, Ubuntu, Debian
bionic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Not vulnerable
(4.15.0-1030.31~16.04.1)
linux-azure
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1002.2)
disco Not vulnerable
(4.18.0-1003.3)
eoan Not vulnerable
(5.0.0-1004.4)
precise Does not exist

trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (4.16~rc1)
xenial
Released (4.15.0-1013.13~16.04.2)
linux-azure-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1007.8~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-azure-edge
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1002.2)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Ignored
(was pending \[4.15.0-1013.13~16.04.2\] now end-of-life)
linux-gcp
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1001.1)
disco Not vulnerable
(4.18.0-1002.3)
eoan Not vulnerable
(5.0.0-1004.4)
precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial
Released (4.15.0-1014.14~16.04.1)
linux-gcp-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1008.9~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-gcp-edge
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1001.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-gke-4.15
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1030.32)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-gke-5.0
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1011.11~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-gke-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1011.12~18.04.1)
eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-hwe
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.18.0-13.14~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial
Released (4.15.0-24.26~16.04.1)
linux-hwe-edge
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-15.16~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Ignored
(was pending \[4.15.0-24.26~16.04.1\] now end-of-life)
linux-kvm
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1002.2)
disco Not vulnerable
(4.18.0-1003.3)
eoan Not vulnerable
(5.0.0-1004.4)
precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial
Released (4.4.0-1062.69)
linux-lts-trusty
Launchpad, Ubuntu, Debian
bionic Does not exist

disco Does not exist

eoan Does not exist

precise Ignored
(was needs-triage ESM criteria)
trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-lts-xenial
Launchpad, Ubuntu, Debian
bionic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (4.16~rc1)
xenial Does not exist

linux-oem
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1002.3)
disco Not vulnerable
(4.15.0-1021.24)
eoan Not vulnerable
(4.15.0-1035.40)
precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Ignored
(was needs-triage now end-of-life)
linux-oem-5.4
Launchpad, Ubuntu, Debian
bionic Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-oem-osp1
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1010.11)
disco Not vulnerable
(5.0.0-1010.11)
eoan Not vulnerable
(5.0.0-1010.11)
precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-oracle
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1007.9)
disco Not vulnerable
(4.15.0-1007.9)
eoan Not vulnerable
(4.15.0-1011.13)
precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Not vulnerable
(4.15.0-1007.9~16.04.1)
linux-oracle-5.0
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1007.12~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-raspi2
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.15.0-1006.7)
disco Not vulnerable
(4.18.0-1005.7)
eoan Not vulnerable
(5.0.0-1006.6)
precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial
Released (4.4.0-1125.134)
linux-raspi2-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1017.19~18.04.1)
eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial Does not exist

linux-snapdragon
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1053.57)
disco Not vulnerable
(5.0.0-1010.10)
eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (4.16~rc1)
xenial
Released (4.4.0-1129.137)