module

Android Binder Use-After-Free Exploit

Disclosed
2019-09-26

Description

This module exploits CVE-2019-2215, which is a use-after-free in Binder in the
Android kernel. The bug is a local privilege escalation vulnerability that
allows for a full compromise of a vulnerable device. If chained with a browser
renderer exploit, this bug could fully compromise a device through a malicious
website.
The freed memory is replaced with an iovec structure in order to leak a pointer
to the task_struct. Finally the bug is triggered again in order to overwrite
the addr_limit, making all memory (including kernel memory) accessible as part
of the user-space memory range in our process and allowing arbitrary reading
and writing of kernel memory.
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.