● CVE-2024-32896 / In-The-Wild Zero-Day

CVE-2024-32896: Android Binder IPC Driver Privilege Escalation Teardown

How an actively exploited transaction descriptor refcount overflow in drivers/android/binder.c allowed malicious apps to escalate to full root privileges.

💡 Explicación en Lenguaje Sencillo (ELI5)

Imagine a coat-check attendant who gives you a claim ticket. If you ask for 65,536 tickets, his tiny counter rolls back to 0. He thinks you have zero coats checked, but you still hold the claim stubs. When another customer drops off a priceless jewel, he gives it the claim number 1—and you hand him your duplicate stub, walking out with the crown jewels.

Conceptos Centrales y Términos del Subsistema

Binder IPC
The primary inter-process communication mechanism in Android, allowing apps and system services to exchange data and handles across process boundaries.
binder_node
The kernel structure representing a remote service or object exposed via Binder.
Reference Count Overflow
Incrementing an integer counter past its maximum value, causing it to wrap around back to zero or negative values.
system_server
The core Android system daemon orchestrating all device permissions, telephony, and window management.

Mecánica del Ataque Paso a Paso

Step 1

1. Malicious App Initial Access

An untrusted zero-permission Android app opens /dev/binder.

Step 2

2. High-Frequency Transaction Spray

The app repeatedly creates transactional node references until the 32-bit counter wraps around.

Step 3

3. Premature Binder Node Deallocation

The kernel marks the node as unreferenced and frees its slab memory.

Step 4

4. Arbitrary Kernel Code Execution

The app reallocates the memory with a fake function pointer table, hijacking kernel control flow.

Código Fuente: Fallo Fatal vs. Corrección Segura

Entregado en código fuente legible de alto nivel (sin ensamblador ni diffs binarios).

FALLO SIN CORREGIR
// VULNERABLE: drivers/android/binder.c before patch
static void binder_inc_node_nil(struct binder_node *node) {
    // ROOT CAUSE:
    // Raw unsigned increment without checking for integer overflow saturation!
    node->internal_strong_refs++;
    if (node->internal_strong_refs == 0) {
        // Wrapped around! Node will be prematurely destroyed!
        binder_free_node(node);
    }
}
PARCHE SEGURO
// SECURE: drivers/android/binder.c patch
static void binder_inc_node_nil(struct binder_node *node) {
    // 1. Enforce atomic saturating reference count arithmetic
    if (unlikely(node->internal_strong_refs == UINT_MAX)) {
        pr_err("binder: strong ref overflow detected, killing task\n");
        binder_user_error("binder: node ref overflow\n");
        return;
    }
    
    // 2. Safely increment verified counter
    node->internal_strong_refs++;
}

Lista de Verificación para Ingeniería y Mitigación

← Explorar Directorio de Seguridad Todas las Actualizaciones de Seguridad →