Bad Binder: Android In-The-Wild Exploit
Summary: Project Zero disclosed CVE-2019-2215 on October 3, 2019, a use-after-free in the Android kernel's Binder driver that allows local privilege escalation and full device compromise, and reported it under a 7-day deadline based on credible evidence an exploit existed in the wild. The bug was originally found by syzkaller in November 2017 and patched in Linux 4.14 and Android 3.18, 4.4, and 4.9 kernels in February 2018, but the fix was never included in an Android monthly security bulletin, leaving devices such as Pixel and Pixel 2 unpatched.
Key Takeaway: Google's Threat Analysis Group, Android Security, and Project Zero received information suggesting NSO had a 0-day Android exploit that installed Pegasus spyware, and the kernel bug it relied on had sat unpatched on Pixel and Pixel 2 since February 2018 because the fix never made a monthly bulletin.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-2215
- Related
- CVE-2019-2215: Android Kernel Use-After-Free Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026