CVE_2019_2215

CVE-2019-2215 - Escalada de privilegios local por UAF en Android Binder Un exploit reescrito de Prueba de Concepto / Escalada de Privilegios Local LPE que apunta a CVE-2019-2215 , una vulnerabilidad de uso después de liberación Use-After-Free en el controlador Android Binder. He proporcionado la...

CVE-2020-0423

非常感谢所有发布其工作的其他安全研究人员，他们允许他人学习并进行独立研究。 Resources: Original exploit article via longterm.io: https://www.longterm.io/cve-2020-0423.html Repo from Github user 20000s, also looking into 2020-0423: https://github.com/20000s/androidcve/tree/main Typhoon Black Hat presentation, documenting 2020-0423 as...

CVE-2019-2215

CVE-2019-2215 Bad Binder 针对 Android 10 x8664 AVD 的 CVE-2019-2215 PoC。基于 elbiazo/CVE-2019-2215，内核参考 cloudfuzz workshop。 仅供在隔离环境（模拟器）中研究使用。 构建： BUILD.md root@kitploit: source ./setup-env.sh ./scripts/start-emulator.sh ./scripts/run-exploit.sh 运行前需要在 kernels/ 中准备自定义 bzImage（参见 BUILD.md）。...

CVE-2019-2215

Bad-Binder CVE-2019-2215 以下是针对 bad binder CVE-2019-2215 漏洞的利用程序，已在 x86 模拟器上测试。其目的是利用 UAF 漏洞触发 AAR 原语来泄漏内核地址，并使用 AAW 原语覆盖 addrlimit，从而获得内核读写原语，使我们可以修改 credstruct 以实现本地权限提升 LPE。 致谢 https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html...

CVE-2020-0423

CVE-2020-0423 针对CVE-2020-0423的利用程序，这是一个Binder延迟工作UAF漏洞。 目前WIP ，因为这是一系列持续更新的博客文章 @ wired0ut.github.io...

CVE-2019-2215

CVE-2019-2215 由 @wired0ut 编写的 Android Bad Binder 漏洞利用工具。 它利用 UAF 泄漏 taskstruct，然后覆盖 addrlimit，并通过覆盖 cred 中的 id 块来提升权限。 研究的完整流程和利用细节可在此处找到（共三部分）：这里 已在 goldfish Android 内核（arm64，版本 4.14，补丁已重新引入）上测试通过。 运行示例： root@kitploit: $ whoami whoami: unknown uid 1000 $ ./poc ! Starting first phase of exploit;...

CVE-2019-2215

CVE-2019-2215 CVE-2019-2215 — Android Binder Use-After-Free 权限提升 描述 针对 CVE-2019-2215 漏洞的利用程序 — Android 内核 binder 驱动中的 use-after-free。可在存在漏洞的设备上将权限提升至 root。 漏洞 CVE-2019-2215 — binderthread 在使用 epoll 时发生 use-after-free。该错误源于 binderpoll 中 wait 队列处理不当，从而导致能够重写内核内存。 工作原理 root@kitploit: 1...

cve-2019-2215-markw

Bad Binder for markw !CAUTION Everything you do is at your own risk. I am not responsible for your broken device. Adapted with Deepseek V4 Flash Made for the latest Global MIUI 10. Overview Main goal: Get temp root on latest official miui Root can be used for flashing custom abootwhich is what I...

CVE-2019-2215

CVE-2019-2215 免责声明：此处提供的代码仅供教育和展示目的。我不支持，也不对任何将此代码（或其信息、其构建、或本仓库中的任何内容）用于非法或不道德目的的人承担责任 致谢 基于 Google Project Zero 的 Jann Horn 和 Maddie Stone 的概念验证 特别感谢 CloudFuzz 的工作坊，让我能够编写此漏洞利用程序。 另外感谢 kangtastic 提供了另一个参考来源。 使用方法 要构建漏洞利用程序： root@kitploit: NDKROOT=/Android/Sdk/ndk/22.0.7026061 make...

android-kernel-exploitation-lab

Android 内核利用实验室（Android Kernel Exploitation Lab） 本实验室将引导您搭建环境，以探索 CVE-2019-2215——Binder 子系统中一个关键的 Android 内核漏洞。 文档 环境搭建 使用 GDB 脚本实现内核提权 使用 syzkaller 进行模糊测试 使用 AFL++ 进行模糊测试 技术细节：CVE-2019-2215 该漏洞是 Android Binder 驱动中的一个释放后使用（use-after-free）漏洞，具有以下特征： 1. 根本原因 ：当 binder fd 被添加到一个 epoll...

PoCForCVE-2015-1528

This PoC is divided into three Parts, the folder mediaserver help to inject code into mediaserver from a normal application. the folder surfaceflinger help to inject code to surfaceflinger after you got mediaserver permission. the folder systemserver help to inject code to systemserver after you...

badspin

Bad Spin: Android Binder LPE 作者：Moshe Kol 从 unstrustedapp 出发的 Android Binder 漏洞（CVE-2022-20421）权限提升利用代码。该漏洞已在 2022 年 10 月的 Android 安全公告中修复。漏洞利用程序适用于运行内核版本 5.4.x 和 5.10.x 的设备，并可获得完整的内核读写原语。对于 Google Pixel 6，还能实现完全 root 和绕过 SELinux。 完整的分析文章可在此处找到。 从 shell 运行 1. 在 src/ 目录下执行 make push 编译 libbadspin....

CVE-2023-20938-Public

README This repository contains a bug trigger for CVE-2023-20938 intended to demonstrate and study the vulnerability behavior. QEMU emulation : The bug trigger for reproducing the issue under QEMU is located in the libdevbinder/ directory. Real devices : The bug trigger intended for execution on...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001462 advisory. In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually...

perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution.

A flaw was found in perl-DBI. A heap overflow vulnerability exists when preparsing SQL statements with more than 9 binders. The preparse method incorrectly allocates buffer space for SQL placeholder characters, leading to an overflow when processing binders with two or more digits. This can resul...

Important: perl-DBI

Issue Overview: DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Binder: Signals for epoll threads that perform self-work In epoll mode, threads often rely on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDERWRITEREAD without...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: binder: A check for offset alignment was added in bindergetobject. Commit 6d98eb95b450 “binder: avoid potential data leakage when copying txn” introduced changes to the way binder objects are copied. As a result, the offset...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Binder: Fixed a UAF Use-After-Free issue caused by a race condition involving ref-proc. A transaction of type BINDERTYPEWEAKHANDLE may fail to increment the reference count of a node. In this case, the target proc normally releas...

Astra Linux – Vulnerability in Linux

In the binderreleasework function of binder.c, there is a potential use-after-free issue due to improper locking. This could lead to a local escalation of privileges in the kernel, without the need for additional execution privileges. User interaction is not required for exploitation. Product:...