● CVE-2024-32896 / In-The-Wild Zero-Day

CVE-2024-32896: Android Binder IPC Driver Privilege Escalation Teardown

How an actively exploited transaction descriptor refcount overflow in drivers/android/binder.c allowed malicious apps to escalate to full root privileges.

💡 Explication en Termes Simples (ELI5)

Imagine a coat-check attendant who gives you a claim ticket. If you ask for 65,536 tickets, his tiny counter rolls back to 0. He thinks you have zero coats checked, but you still hold the claim stubs. When another customer drops off a priceless jewel, he gives it the claim number 1—and you hand him your duplicate stub, walking out with the crown jewels.

Concepts Clés et Termes du Sous-système

Binder IPC
The primary inter-process communication mechanism in Android, allowing apps and system services to exchange data and handles across process boundaries.
binder_node
The kernel structure representing a remote service or object exposed via Binder.
Reference Count Overflow
Incrementing an integer counter past its maximum value, causing it to wrap around back to zero or negative values.
system_server
The core Android system daemon orchestrating all device permissions, telephony, and window management.

Mécanique d'Exécution Étape par Étape

Step 1

1. Malicious App Initial Access

An untrusted zero-permission Android app opens /dev/binder.

Step 2

2. High-Frequency Transaction Spray

The app repeatedly creates transactional node references until the 32-bit counter wraps around.

Step 3

3. Premature Binder Node Deallocation

The kernel marks the node as unreferenced and frees its slab memory.

Step 4

4. Arbitrary Kernel Code Execution

The app reallocates the memory with a fake function pointer table, hijacking kernel control flow.

Code Source : Faille Critique vs. Correctif Sécurisé

Fourni en code source de haut niveau lisible (sans assembleur brut ni diff binaire).

FAILLE NON CORRIGÉE
// VULNERABLE: drivers/android/binder.c before patch
static void binder_inc_node_nil(struct binder_node *node) {
    // ROOT CAUSE:
    // Raw unsigned increment without checking for integer overflow saturation!
    node->internal_strong_refs++;
    if (node->internal_strong_refs == 0) {
        // Wrapped around! Node will be prematurely destroyed!
        binder_free_node(node);
    }
}
CORRECTIF RENFORCÉ
// SECURE: drivers/android/binder.c patch
static void binder_inc_node_nil(struct binder_node *node) {
    // 1. Enforce atomic saturating reference count arithmetic
    if (unlikely(node->internal_strong_refs == UINT_MAX)) {
        pr_err("binder: strong ref overflow detected, killing task\n");
        binder_user_error("binder: node ref overflow\n");
        return;
    }
    
    // 2. Safely increment verified counter
    node->internal_strong_refs++;
}

Checklist d'Ingénierie et de Durcissement Système

← Parcourir l'Annuaire de Sécurité Tous les Bulletins de Sécurité →