# MA-752.102019: MyCERT Alert - Android Use-After-Free Vulnerability / Local Privileges Escalation (CVE-2019-2215)

**Date:** 09 Oct 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-752.102019  
**Advisory ID:** MA-752.102019

---

**1.0 Introduction**
Google through Project Zero had discovered a new Android zero-day vulnerability that actually used targeting several vulnerable Android smartphones.
It is actually a use-after-free vulnerability that can be exploited to achieve kernel local privilege escalation. It was discovered in Android binder driver where  “waitqueue” data structure is not removed after it was freed once a thread is exited.
From there, attacker can write new instruction to either crash Android or pointing to address of shellcode and achieving execution of  arbitrary code. It was also reported that this vulnerability has been used in the wild which has been discovered by Google's Threat Analysis Group.
**2.0 Impact**
- Such exploit if chained with another Chrome’s renderer processes bug, enable it to be spread just by browsing a malicious website.
- Successful exploitation may allow attacker to get full control of the hacked Android device.
**3.0 Affected System and Devices**
Android phone:
- Pixel 2 with Android 9 and Android 10 preview
- Pixel 1
- Huawei P20
- Xiaomi Redmi 5A
- Xiaomi Redmi Note 5
- Xiaomi A1
- Oppo A3
- Moto Z3
- Oreo LG phones (run same kernel according to website)
- Samsung Galaxy S7, S8, S9
**4.0 Recommendations**
As of this alert has been written, only Pixel 1 and Pixel 2 devices will receive the patch for CVE-2019-2215 as part of the October update. Pixel 3 and Pixel 3a devices are not vulnerable to this issue.
Android phone users are advised to update their devices to the latest version whenever it’s available.
- It's up to the device manufacturer, and mobile carrier if appropriate, to approve and pass on fixes.
- Certain Google devices, primarily Pixel and older Nexus devices, get them directly from Google itself, and its Play services can in some cases push patches straight to the devices.
General best practice for smartphone users:
- Verify an app's permission before installing it i.e. online banking app shouldn’t require access to camera, microphone and SMS permission.
- Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
- Verify given URLs with the official financial institution or law enforcement agency website. On mobile, site URL may appear differently from desktop browser, make sure to verify it too.
- Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
- Don't use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user's smartphone/tablet.
- Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
- **Do not root your phone**. This give administrator privileges to access the device filesystem and malicious app could take advantage.
- Avoid side loading (installing from non-official sources) when you can. If you do install Android software from other sources than the official app store, be sure that it is coming from a reputable source.
- Please ensure to turn off the “Unknown Source” option in the Security Settings page.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1942
- https://source.android.com/security/bulletin/pixel/2019-10-01
- https://www.bleepingcomputer.com/news/security/actively-exploited-android-zero-day-impacts-google-samsung-devices/