CVE-2019-2215 in google android
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
Affected software: google android, debian linux, canonical ubuntu linux, netapp cloud backup, netapp data availability services, netapp hci management node, netapp service processor, netapp solidfire, netapp steelstore cloud integrated storage, netapp solidfire baseboard management controller firmware
Scores
- CVSS: 7.8 (high)
- EPSS: 72.10% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2021-11-03
- Published: 2019-10-11
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update Android devices and Linux kernels for the binder use-after-free (CVE-2019-2215)
Patch or upgrade. Installs the kernel fix for the binder use-after-free that lets a malicious local app gain kernel privileges. Android devices need the October 2019 security patch level or the vendor firmware that contains it; Debian kernels carry the fix too, although Debian does not enable the binder driver.
Applies to: Android devices with a security patch level before 2019-10-06 (Pixel 2, Huawei P20, Samsung Galaxy S7/S8/S9 and others on kernels 3.18, 4.4, 4.9 without the fix); Debian 8 linux before 3.16.81-1 and linux-4.9 before 4.9.210-1~deb8u1 (binder not enabled in Debian builds).
- Inventory Android devices in your MDM (Intune, Workspace ONE, Google Endpoint Management) and read their Android security patch level.
- Mark every device with a security patch level older than 2019-10-06 as vulnerable.
- Push the latest vendor system update to those devices through the MDM, or have users install it via Settings > System > System update.
- For Huawei/Honor devices, install at least the fixed firmware listed for the model in Huawei advisory huawei-sa-20191030-01-binder (for example HUAWEI P20: 9.1.0.312(C00E312R1P1T8)).
- Devices that no longer receive updates: retire them or block them from corporate resources with an MDM compliance policy requiring patch level 2019-10-06 or later.
- Debian 8 hosts: upgrade the linux package to 3.16.81-1 (linux-4.9 to 4.9.210-1~deb8u1) or later with 'apt-get update && apt-get upgrade', then reboot.
- Other Linux hosts that build their own kernel with CONFIG_ANDROID_BINDER_IPC enabled: upgrade to a kernel from your distribution that includes the fix, or disable the binder driver.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.