CVE-2019-1999: android Double Free
Vulnerability summary
CVE-2019-1999 is a high (CVSS 7.8) Double Free vulnerability in android. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 28-02-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-120025196.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.81%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.81% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAndroid - binder Use-After-Free of VMA via race Between reclaim and munmap
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ubuntu10 products
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-azure-fdeAll versions (No fix recorded)
- linux-azure-fips< 4.15.0-2006.7 | All versions (No fix recorded)
- linux-gcp-fipsAll versions (No fix recorded)
- linux-gkeAll versions (No fix recorded)
Debian2 products
- linux< 5.2.6-1
- debian_linuxEOL9.0 | 10.0
Android1 product
- androidAndroid kernel
Canonical1 product
- ubuntu_linuxEOL19.04
Google1 product
- androidna
5 vendors · 15 products
