Which products and versions are affected by CVE-2019-2215?

Affected: Cloud Backup (Netapp); Data Availability Services (Netapp); Hci Management Node (Netapp), among others. The full list is in the CVE brief.

Is CVE-2019-2215 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 26, 2019.

Is CVE-2019-2215 in the CISA KEV catalog?

Yes. It was added on Nov 3, 2021 with a federal remediation due date of May 3, 2022.

Is there a public exploit for CVE-2019-2215?

Public exploit code is available.

How urgently should CVE-2019-2215 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2019-2215

HighExploitedPublic exploit

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.

Published Oct 11, 2019 · Updated Sep 9, 2026 · Also known as DEBIAN-CVE-2019-2215, UBUNTU-CVE-2019-2215

Key Facts

Patch immediately

CVE-2019-2215 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Cloud Backup (Netapp), Data Availability Services (Netapp), Hci Management Node (Netapp) and 22 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 26, 2019. Public exploit code is available.
EPSS estimates a 72% probability of exploitation in the next 30 days.
Fixed versions are available, including Alp-Al00b Firmware 10.0.0.162\(c00e156r2p4\), Alp-Tl00b Firmware 10.0.0.162\(c01e156r1p4\), Anne-Al00 Firmware 9.1.0.126\(c00e126r1p7t8\).
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

72%

Higher than 99.4% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2019-2215 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Nov 3, 2021	May 3, 2022	Not reported
Industry KEV feed	Sep 26, 2019	May 3, 2022	Not reported
CIRCL KEV	Nov 3, 2021	May 3, 2022	Not reported
ENISA EUVD	Nov 3, 2021	n/a	Not reported

Required action: Apply updates per vendor instructions.

Affected Products

116 affected entries in total

Product	Affected versions	Fixed in
Cloud BackupNetapp	See advisory	n/a
Data Availability ServicesNetapp	See advisory	n/a
Hci Management NodeNetapp	See advisory	n/a
Service ProcessorNetapp	See advisory	n/a
SolidfireNetapp	See advisory	n/a

20 more affected products in the full CVE brief

Patched Releases

Alp-Al00b Firmware

10.0.0.162\(c00e156r2p4\)

Alp-Tl00b Firmware

10.0.0.162\(c01e156r1p4\)

Anne-Al00 Firmware

9.1.0.126\(c00e126r1p7t8\)

Ares-Al00b Firmware

9.1.0.165\(c00e165r2p5t8\)

Ares-Al10d Firmware

9.1.0.165\(c00e165r2p5t8\)

Ares-Tl00chw Firmware

8.2.0.163\(c01r2p1\)

Barca-Al00 Firmware

8.0.0.377\(c00\)

Berkeley-L09 Firmware

9.1.0.351\(c432e5r1p13t8\)

Berkeley-Tl10 Firmware

9.1.0.333\(c01e333r1p1t8\)

Bla-Al00b Firmware

10.0.0.170\(c786e170r2p4\)

Bla-L29c Firmware

9.1.0.300\(c432e4r1p11t8\)

Bla-Tl00b Firmware

10.0.0.170\(c01e170r1p4\)

Columbia-Al00a Firmware

8.1.0.186\(c00gt\)

Columbia-L29d Firmware

9.1.0.325\(c432e4r1p12t8\)

Cornell-Tl10b Firmware

9.1.0.321\(c01e320r1p1t8\)

Duke-L09i Firmware

9.0.1.171\(c675e6r1p5t8\)

huawei dura-al00a firmware

1.0.0.190\(c00\)

huawei figo-al00a firmware

9.1.0.130\(c00e115r2p8t8\)

huawei florida-al20b firmware

9.1.0.128\(c00e112r1p6t8\)

huawei florida-l03 firmware

9.1.0.154\(c605e7r1p2t8\)

huawei florida-l21 firmware

9.1.0.154\(c605e7r1p2t8\)

huawei florida-l22 firmware

9.1.0.150\(c636e6r1p5t8\)

huawei florida-tl10b firmware

9.1.0.128\(c01e112r1p6t8\)

huawei honor 9i firmware

9.1.0.130\(c00e112r2p10t8\)

huawei honor view 20 firmware

10.1.0.214\(c10e5r4p3\)

Timeline

Added to Industry KEV feed
Sep 26, 2019
Publicly disclosed
Oct 11, 2019
Added to CISA KEV
Nov 3, 2021
Added to CIRCL KEV
Nov 3, 2021
Added to ENISA EUVD
Nov 3, 2021
Last updated
Sep 9, 2026

Weakness Type

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416 Use After Free

References

15 more references in the full CVE brief

FAQ

Common Questions.

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.
Affected: Cloud Backup (Netapp); Data Availability Services (Netapp); Hci Management Node (Netapp), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 26, 2019.
Yes. It was added on Nov 3, 2021 with a federal remediation due date of May 3, 2022.
Public exploit code is available.
Fixed versions are available, including Alp-Al00b Firmware 10.0.0.162\(c00e156r2p4\), Alp-Tl00b Firmware 10.0.0.162\(c01e156r1p4\), Anne-Al00 Firmware 9.1.0.126\(c00e126r1p7t8\).
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2019-2215 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.