Description
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Android | Kernel | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.15.4-1 | — |
| Debian 13 | linux | 4.15.4-1 | — |
| Debian 12 | linux | 4.15.4-1 | — |
| Debian 8 | linux | 3.16.81-1 | DLA-2068-1 |
| Debian 8 | linux-4.9 | 4.9.210-1~deb8u1 | DLA-2114-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +2 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-snapdragon | 4.15.0-1053.57 | — |
| Ubuntu 16.04 LTS | linux | 4.4.0-168.197 | USN-4186-1 |
| Ubuntu 16.04 LTS | linux-aws | 4.4.0-1098.109 | USN-4186-1 |
| Ubuntu 16.04 LTS | linux-azure | 4.15.0-1013.13~16.04.2 | — |
| Ubuntu 16.04 LTS | linux-gcp | 4.15.0-1014.14~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe | 4.15.0-24.26~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu 16.04 LTS | linux-kvm | 4.4.0-1062.69 | USN-4186-1 |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1125.134 | — |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1129.137 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | 4.4.0-1025.30 | — |
| Ubuntu Pro 14.04 LTS | linux-aws | 4.4.0-1058.62 | — |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-168.197~14.04.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Android Binder Use-After-Free Exploit
exploit/android/local/binder_uaf
Exploit-DB 2
- Android Binder - Use-After-Free (Metasploit) EDB-48129 · local · Feb 24, 2020 · verified
- Android - Binder Driver Use-After-Free EDB-47463 · local · Oct 4, 2019 · verified
GitHub 38 repositories · most starred shown
-
kangtastic/cve-2019-2215 ★ 138 · Oct 14, 2019
Temproot for Pixel 2 and Pixel 2 XL via CVE-2019-2215
-
timwr/CVE-2019-2215 ★ 79 · Oct 4, 2019
-
sharif-dev/AndroidKernelVulnerability ★ 73 · Jun 7, 2020
Triggering and Analyzing Android Kernel Vulnerability CVE-2019-2215
-
0xbinder/android-kernel-exploitation-lab ★ 46 · Mar 13, 2025
This lab guides you through setting up an environment to explore CVE-2019-2215, a critical Android kernel vulnerability in the binder subsystem.
-
DimitriFourny/cve-2019-2215 ★ 41 · Feb 17, 2020
Android privilege escalation via an use-after-free in binder.c
-
LIznzn/CVE-2019-2215 ★ 26 · Jan 30, 2020
Temproot for Bravia TV via CVE-2019-2215.
-
stevejubx/CVE-2019-2215 ★ 17 · Nov 5, 2023
Android Kernel Vulnerability (CVE-2019-2215) temporary root PoC
-
c3r34lk1ll3r/CVE-2019-2215 ★ 14 · Oct 27, 2020
PoC for old Binder vulnerability (based on P0 exploit)
-
flipphoneguy/root-sonim-xp3800 ★ 12 · Jun 30, 2026
app that ports CVE-2019-2215 to arm32 and mounts a su binary to /sbin with denylist + root app installer. firehose/Magisk guide included
-
R0rt1z2/huawei-unlock ★ 12 · May 20, 2024
Unlock your Huawei device with ADB (CVE-2019-2215)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- USN-4186-1 linux, linux-aws, linux-kvm vulnerabilities Ubuntu Security Notices (USN) · Sep 9, 2026
- DLA-2114-1 linux-4.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2068-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://source.android.com/security/bulletin/2019-10-01
- 20191018 CVE 2019-2215 Android Binder Use After Free mailing-list
- http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en
- https://security.netapp.com/advisory/ntap-20191031-0005/
- 20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01) mailing-list
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- USN-4186-1 vendor-advisory
- [debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update mailing-list
- http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html
- [debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update mailing-list