Researcher releases PoC rooting app that exploits recent Android zero-day
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2215 | Use-After-Free Privilege Escalation in Android Kernel (CVE-2019-2215) CVE-2019-2215 is a use-after-free flaw (CWE-416) in the Android kernel's binder.c IPC driver that allows privilege escalation from an application to the Linux kernel. Exploitation requires no user interaction, but an attacker must either run a malicious local application or chain the bug with a vulnerability in a network-facing application. Successful exploitation yields kernel-level code execution, effectively rooting the device and giving the attacker full control over apps, data, and communications. Affected parties include Android devices with unpatched kernels (reporting at the time indicated most Android phones were affected), plus products shipping affected Android kernel code, including Google Android, Debian/Ubuntu builds, and NetApp and Huawei offerings. The flaw was publicly disclosed and patched in Android's October 2019 security updates, public proof-of-concept exploits exist, and it is listed in CISA's Known Exploited Vulnerabilities catalog with a high (72.1%) EPSS probability of exploitation; headlines confirm in-the-wild use, including a Google Play app that leveraged it to deliver spyware. Do: Apply vendor-supplied updates per CISA's required action — for phones and tablets, ensure the device is on the October 2019 Android security patch level or later (check Settings > About phone > Android security patch level) and patch via MDM across your fleet; NetApp, Huawei, Debian, and Ubuntu customers should install their vendors' corresponding kernel updates. Because this is a local privilege escalation with no user interaction required, also patch any network-facing applications that could be chained with it, and hunt for signs of exploitation such as unexpected root or unknown sideloaded/rooting apps on managed devices. | 7.8 | 72% | KEV PoC ×2 |
| massbillions of devices |
Full article344 words · extracted from helpnetsecurity.com · click to collapse
Late last month Google Project Zero researcher Maddie Stone detailed a zero-day Android privilege escalation vulnerability (CVE-2019-2215) and revealed that it is actively being exploited in attacks in the wild. She also provided PoC code that could help researchers check which Android-based devices are vulnerable and which are not.
One of those has decided to go further.
Achieving “root” through a malicious app
“The base PoC left us with a full kernel read/write primitive, essentially game over for the systems’ security, but left achieving root as an exercise for the reader,” said Grant Hernandez, a Ph.D student at the University of Florida and a Research Assistant with the Florida Institute of Cyber Security.
He took it upon himself to find a way to achieve “root” on a vulnerable device, to bypass the various protections Android employs against malicious applications, and to see whether the exploit could be made to work from an application context.
As it turns out, it could: he created Qu1ckR00t, a PoC one-click rooting application, the code for which he published on GitHub.
But, he warned, the app has only been tested on a Pixel 2 and will probably not work on other devices/kernel versions, leading most probably to a crash or data loss. “It should not be used on your personal device with valuable userdata,” he advised.
About CVE-2019-2215
CVE-2019-2215 was initially discovered and patched in late 2017 in v4.14 of the Linux kernel and in Android versions 3.18, 4.4, and 4.9, but the fix was apparently never propagated to later Android versions.
That’s why certain of Pixel, Huawei, Oppo, Moto, LG and Samsung mobile devices running Android 8 through 10 featured it.
CVE-2019-2215 is believed to be exploited by lawful surveillance software by NSO Group.
Google produced a fix a week after Stone shared the info and the PoC, and delivered it as part of the October 2019 Android security patches.
Vulnerable Pixel-branded phones have already received the patch. Users of Huawei, LG, Samsung, Xiaomi and Oppo devices are still waiting.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/10/17/android-root-cve-2019-2215/