According to a bug report, there is a use-after-free vulnerability (CVE-2019-2215) in the Android Kernel. Upon an exploit, the bug could allow an attacker to gain root access to the target device. As described,
binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free.While Google patched this flaw already in previous Android versions, it resurfaced in recent versions. Specifically, it affects devices running Android 8.x and later. Therefore, it doesn’t pose a threat to older smartphones, rather the more recent models.
This issue was patched in Dec 2017 in the 4.14 LTS kernel [1], AOSP android 3.18 kernel [2], AOSP android 4.4 kernel [3], and AOSP android 4.9 kernel [4], but the Pixel 2 with most recent security bulletin is still vulnerable based on source code review.Vulnerable devices include (but not limited to):
This issue is rated as High severity on Android and by itself requires installation of a malicious application for potential exploitation. Any other vectors, such as via web browser, require chaining with an additional exploit.They also confirmed that the patch is available with Android Common Kernel. While the Pixel 3 and 3a devices are safe, Pixel 1 and 2 will receive fixes for this bug with October updates.
