nestle19/cve-2019-2215Android kernel exploit for CVE-2019-2215, a use-after-free in the Binder driver, enabling privilege escalation to root via memory corruption and cred patching on vulnerable ARM64 devices.
CVE-2019-2215 — Android Binder Use-After-Free Privilege Escalation Description
Exploit for vulnerability CVE-2019-2215 — use-after-free in the Android kernel binder driver. Allows privilege escalation to root on vulnerable devices. Vulnerability
CVE-2019-2215 — use-after-free in binder_thread when working with epoll. The bug arises from incorrect handling of the wait queue in binder_poll(), leading to the possibility of kernel memory overwrite.
How it works
Pointer leak (leakTaskStruct)
A race between epoll and binder results in reading the current process's task_struct pointer via writev/pipe.
Address limit overwrite (clobberAddrLimit)
The same race is used to write 0xFFFFFFFFFFFFFFFE into the addr_limit field of the task_struct, granting access to all kernel memory.
Credential patching (patchCred)
Through a pipe channel (kernel_fd), the current process's cred structure is read and overwritten:
UID/GID = 0 (root)
Full capabilities (CAP_FULL_SET)
Disable SELinux (disableSELinuxEnforcing)
The kernel base address is computed via nsproxy, and the selinux_enforcing flag is zeroed.
Launch a root shell: system("/bin/sh")
Requirements
Device with a vulnerable version of Android (before the October 2019 patch)
ARM64 architecture
/dev/binder present
Compilation requires specifying kernel symbols:
init_nsproxy — for computing the kernel base
selinux_enforcing — for disabling SELinux
Symbols can be obtained from /proc/kallsyms on the target system.