Double Free in Android
CVE-2019-1999
In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-120025196.
Vulnerability class: Double Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: +0.000
Affected products
- Android — versions Android kernel
- Google Android
- Canonical Ubuntu Linux — versions 19.04
- Debian Linux — versions 9.0, 10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/106851 (vdb-entry, Broken Link)
- source.android.com/security/bulletin/2019-02-01 (Vendor Advisory)
- www.exploit-db.com/exploits/46357/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- usn.ubuntu.com/3979-1/ (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2019/dsa-4495 (vendor-advisory, Third Party Advisory)
- seclists.org/bugtraq/2019/Aug/13 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-1999?
- CVE-2019-1999 is a high-severity vulnerability in Android, classified under Double Free. CVSS score: 7.8/10. Published 2019-02-28.
- How severe is CVE-2019-1999?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-1999 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.