CVE-2023-20938

CVE-2023-20938 Vulnerability Analysis 1. Client A and Client B establish a Binder connection via the ServiceManager context manager. 2. A creates node 0xbeef node = bindernewnodeproc, fp;. B references node 0xbeef via ref-targetnode. 3. B correctly processes targetnode 0xbeef, enqueuing the...

CVE-2019-2215

Bad-Binder CVE-2019-2215 The following is the exploit for the bad binder CVE-2019-2215 vulnz that was tested on an x86 Emulator. The aim was to abuse the UAF vulnerability to trigger an AAR primitive to leak kernel addresses and use an AAW primitive to overwrite addrlimit leading to a Kernel Read...

binder-trace

Binder Trace Binder Trace es una herramienta para interceptar y analizar mensajes de Android Binder. Piénsalo como "Wireshark para Binder". Requisitos versión de python = 3.9 ⚙️ Instalación Necesitarás un dispositivo Android rooteado o un emulador. Solo Linux - instala xclip o xsel para la...

CVE-2019-2215

CVE-2019-2215 Exploit for the Bad Binder vulnerability in Android written by @wired0ut. It abuses the UAF in order to leak taskstruct, then overwrites addrlimit and escalates privileges by overwriting the id block in cred. The full flow of the research and exploitation can be found here series of...

CVE-2019-2215

CVE-2019-2215 CVE-2019-2215 — Android Binder Use-After-Free Privilege Escalation Description Exploit for vulnerability CVE-2019-2215 — use-after-free in the Android kernel binder driver. Allows privilege escalation to root on vulnerable devices. Vulnerability CVE-2019-2215 — use-after-free in...

android-badbinder-demo

CVE-2019-2215 Bad Binder — Exploit Analysis This repository is a small test project for researching the vulnerability CVE-2019-2215 Bad Binder and writing a working prototype of an exploit for Android with a simple graphical interface in Kotlin/Jetpack Compose. In the README I: 1. Describe the...

CVE-2019-2215

CVE-2019-2215 AVISO: EL CÓDIGO PROPORCIONADO AQUÍ ES SOLO CON FINES EDUCATIVOS Y DE DEMOSTRACIÓN. NO APOYO, NI ASUMO NINGUNA RESPONSABILIDAD POR CUALQUIER PERSONA QUE USE ESTE CÓDIGO O LA INFORMACIÓN CONTENIDA EN ÉL, O SU CONSTRUCCIÓN, O CUALQUIER COSA EN ESTE REPOSITORIO CON FINES ILEGALES O...

android-kernel-exploitation-lab

Laboratorio de Explotación del Kernel de Android Este laboratorio te guía en la configuración de un entorno para explorar CVE-2019-2215, una vulnerabilidad crítica del kernel de Android en el subsistema binder. Documentación Configuración del Entorno Escalada de privilegios del kernel con script...

badspin

Bad Spin: Android Binder LPE 作者：Moshe Kol 从 unstrustedapp 出发的 Android Binder 漏洞（CVE-2022-20421）权限提升利用代码。该漏洞已在 2022 年 10 月的 Android 安全公告中修复。漏洞利用程序适用于运行内核版本 5.4.x 和 5.10.x 的设备，并可获得完整的内核读写原语。对于 Google Pixel 6，还能实现完全 root 和绕过 SELinux。 完整的分析文章可在此处找到。 从 shell 运行 1. 在 src/ 目录下执行 make push 编译 libbadspin....

CVE-2019-2215

CVE-2019-2215 The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: There is a use-after-free of the wait member in the binderthread struct in the binder driver at /drivers/android/binder.c. As described in the...

CVE-2019-2215

CVE-2019-2215 Andriod binder bug record.Just only test on emulator : ubuntu 22.04 | 4G | 4 cpus andriod studio Pixel2 | Andriod 10.0Q--Google Play Intel x86 Atom 64 System Image | API-29 ndk 21.0.6113669 origin/android-goldfish-4.14-dev | kernel version is 4.14.175 algunas opciones de configuraci...

CVE-2023-20938-poc

CVE-2023-20938 — Escalada de privilegios UAF en binder de Android Una prueba de concepto de escalada de privilegios local para CVE-2023-20938 , un uso después de liberación use-after-free en el driver binder de Android. Desde un shell sin privilegios obtiene uid 0 y establece SELinux a permisivo ...

CVE_2019_2215

CVE-2019-2215 - Android Binder UAF Local Privilege Escalation A rewritten Proof-of-Concept / Local Privilege Escalation LPE exploit targeting CVE-2019-2215 , a Use-After-Free vulnerability in the Android Binder driver. I have provided the vulnerable kernel build in the vulnerablekernelbuilds...

CVE-2020-0423

Big thank you to all the other security research people publishing their work, allowing others to learn, and do independent research. Resources: Original exploit article via longterm.io: https://www.longterm.io/cve-2020-0423.html Repo from Github user 20000s, also looking into 2020-0423:...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Binder: Fix for UAF in alloc-vma during race with munmap cmllamas: Cleaned up the forward port from commit 015ac18be7de “Binder: Fix for UAF in alloc-vma during race with munmap” in 5.10 stable. This was necessary in the mainline...

The vulnerability in the bindertransaction() function of the drivers/android/binder.c module of the Linux kernel-based Android communication driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bindertransaction function in the drivers/android/binder.c module of the Linux kernel communication driver with the Android kernel involves the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

The vulnerability of the binder_update_page_range() function in the drivers/android/binder_alloc.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the binderupdatepagerange function in the drivers/android/binderalloc.c module of the Linux operating system’s kernel is related to the use of memory after deallocation. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity,...

The vulnerability of the binder_inc_ref_for_node() function in the drivers/android/binder.c module of the Linux kernel’s Android communication driver allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the binderincrefornode function in the drivers/android/binder.c module of the Linux kernel’s communication driver with the Android kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-993011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993011 advisory. In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992285)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992285 advisory. In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the...