{"id":"CVE-2019-2215","kind":"vulnerability","aliases":["CVE-2019-2215"],"related":[],"title":"Android Android Kernel: Android Kernel Use-After-Free Vulnerability","description":"A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095","summary":"A use-after-free bug in the Android kernel's binder.c driver lets an app running on the device escalate its privileges to the Linux kernel. Attackers have used it in the wild, chained with other Android kernel flaws.","severity":"high","cvss":7.8,"epss":0.72105,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Android Android Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices"],"not_affected_if":["non-android","patched-device"],"how_to_check":null,"fix":"Apply the Android security patch that addresses CVE-2019-2215 per vendor instructions; the specific patch level is unknown from the sources.","status":"open","published_at":"2019-10-11T19:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:07+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:32:07Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Android security patch that addresses CVE-2019-2215 per vendor instructions; the specific patch level is unknown from the sources.","reach":"local","impact":"high","summary":"A use-after-free bug in the Android kernel's binder.c driver lets an app running on the device escalate its privileges to the Linux kernel. Attackers have used it in the wild, chained with other Android kernel flaws.","category":"infrastructure","who_cares":["android","mobile-devices"],"confidence":0.7,"needs_auth":"yes","worst_case":"Malicious app gains kernel-level control of the Android device.","analyst_note":"Find the Android security bulletin and patch level that fixes CVE-2019-2215 and the affected device/OS versions, via the Android Security Bulletin for 2019-2020 or the kev/epss source links.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-device","non-android"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000468,"input_tokens":2870,"output_tokens":362,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the Android security bulletin and patch level that fixes CVE-2019-2215 and the affected device/OS versions, via the Android Security Bulletin for 2019-2020 or the kev/epss source links.","search":"'-141720095':118C '-2019':12A,15A '-2215':13A,16A 'allow':73C 'android':1A,2A,4A,17A,18A,20B,34B,63B 'androidandroid':115C 'app':41B 'applic':80C,105C 'application.product':114C 'attack':53B 'binder.c':37B,72C 'bug':31B 'chain':60B 'cve':11A,14A 'devic':25B,45B 'driver':38B 'either':98C 'elev':75C 'escal':46B 'exploit':21B,91C,95C 'face':113C 'flaw':65B 'free':9A,30B,70C 'howev':94C 'id':116C 'infrastructur':22B 'instal':100C 'interact':87C 'kernel':3A,5A,19A,35B,52B,64B,84C 'let':39B 'linux':51B,83C 'local':104C 'malici':103C 'mobil':24B 'mobile-devic':23B 'network':112C 'privileg':48B,77C 'requir':89C,97C 'run':42B 'separ':108C 'use':7A,28B,55B,68C 'use-after-fre':6A,27B,67C 'user':86C 'vulner':10A,93C,109C 'wild':59B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-10-11T19:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-2215","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-2215","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2019-2215","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-2215","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-2215","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2215","severity":null,"published_at":"2019-10-11T19:15:10+00:00","modified_at":"2026-06-17T02:33:27+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}