Android Binder.c特权提升漏洞(AbstractEmu)

详细信息

漏洞类型

资源管理错误

漏洞描述

Android是美国谷歌（Google）和开放手持设备联盟（简称OHA）的一套以Linux为基础的开源操作系统。Google Android可能允许经过本地身份验证的攻击者在系统上获得提升的权限，这是由/drivers/android/binder.c中的绑定驱动程序中的use-after-free引起的。 通过执行特制应用程序，攻击者可以利用此漏洞获得提升的权限。

修复建议

升级至Android网站上提供的最新版本： https://www.android.com

参考链接

• https://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• https://source.android.com/security/bulletin/2019-10-01

  NVD · x_refsource_CONFIRM

• http://seclists.org/fulldisclosure/2019/Oct/38

  NVD · mailing-list · x_refsource_FULLDISC

• https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html

  NVD · mailing-list · x_refsource_MLIST

• https://usn.ubuntu.com/4186-3/
• https://usn.ubuntu.com/4186-2/
• https://usn.ubuntu.com/4186-1/

  NVD · vendor-advisory · x_refsource_UBUNTU

• https://vigilance.fr/vulnerability/Google-Android-Pixel-multiple-vulnerabilities-of-October-2019-30549
• https://www.auscert.org.au/bulletins/ESB-2020.0766/
• https://packetstormsecurity.com/files/155309/Ubuntu-Security-Notice-USN-4186-1.html
• https://www.auscert.org.au/bulletins/ESB-2019.4271/
• https://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• https://www.auscert.org.au/bulletins/ESB-2020.0200/
• https://www.exploit-db.com/exploits/47463
• https://mp.weixin.qq.com/s/kJW0wkuH7gg6k5AGO_6pOQ
• https://www.exploit-db.com/exploits/48129
• https://nvd.nist.gov/vuln/detail/CVE-2019-2215
• https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20191030-01-binder-cn
• https://packetstormsecurity.com/files/155335/Ubuntu-Security-Notice-USN-4186-3.html
• https://packetstormsecurity.com/files/154730/Android-Binder-Driver-Use-After-Free.html
• https://seclists.org/bugtraq/2019/Nov/11

  NVD · mailing-list · x_refsource_BUGTRAQ

• https://security.netapp.com/advisory/ntap-20191031-0005/

  NVD · x_refsource_CONFIRM

• http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html

  NVD · x_refsource_MISC

• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

  NVD · x_refsource_MISC

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en

  NVD · x_refsource_CONFIRM

• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

  NVD · mailing-list · x_refsource_MLIST

• http://packetstormsecurity.com/files/156495/Android-Binder-Use-After-Free.html

  NVD · x_refsource_MISC

• https://osv.dev/vulnerability/DLA-2114-1

  OSV

• https://osv.dev/vulnerability/DLA-2068-1

  OSV

• https://ubuntu.com/security/CVE-2019-2215

  OSV

• https://ubuntu.com/security/notices/USN-4186-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2019-2215

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-2215

  OSV

• https://security-tracker.debian.org/tracker/CVE-2019-2215

  OSV

• https://osv.dev/vulnerability/CVE-2019-2215

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-2215

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2215

  NVD