A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• canonical ubuntu linux16.04
• debian debian linux8.0
• google androidall versions
• huawei alp-al00b firmwarebefore 10.0.0.162\(c00e156r2p4\)
• huawei alp-tl00b firmwarebefore 10.0.0.162\(c01e156r1p4\)
• huawei anne-al00 firmwarebefore 9.1.0.126\(c00e126r1p7t8\)
• huawei ares-al00b firmwarebefore 9.1.0.165\(c00e165r2p5t8\)
• huawei ares-al10d firmwarebefore 9.1.0.165\(c00e165r2p5t8\)
• huawei ares-tl00chw firmwarebefore 8.2.0.163\(c01r2p1\)
• huawei barca-al00 firmwarebefore 8.0.0.377\(c00\)
• huawei berkeley-l09 firmwarebefore 9.1.0.351\(c432e5r1p13t8\)
• huawei berkeley-tl10 firmwarebefore 9.1.0.333\(c01e333r1p1t8\)
• huawei bla-al00b firmwarebefore 10.0.0.170\(c786e170r2p4\)
• huawei bla-l29c firmwarebefore 9.1.0.300\(c432e4r1p11t8\)
• huawei bla-tl00b firmwarebefore 10.0.0.170\(c01e170r1p4\)
• huawei columbia-al00a firmwarebefore 8.1.0.186\(c00gt\)
• huawei columbia-l29d firmwarebefore 9.1.0.325\(c432e4r1p12t8\)
• huawei cornell-tl10b firmwarebefore 9.1.0.321\(c01e320r1p1t8\)
• huawei duke-l09i firmwarebefore 9.0.1.171\(c675e6r1p5t8\)
• huawei dura-al00a firmwarebefore 1.0.0.190\(c00\)

Versions reported by the vendor

Affected version ranges reported by the assigning authority (google_android). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Android

  • Kernelaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2011-1823The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows KEV
  73This week
• CVE-2015-1538Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I all
  70This week
• CVE-2015-3829Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows re
  67This week
• CVE-2015-3824The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict si
  67This week
• CVE-2015-3864Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1
  66This week
• CVE-2015-3828The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a min
  66This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.