● CVE-2024-32896 / In-The-Wild Zero-Day

CVE-2024-32896: Android Binder IPC Driver Privilege Escalation Teardown

How an actively exploited transaction descriptor refcount overflow in drivers/android/binder.c allowed malicious apps to escalate to full root privileges.

💡 비유를 통한 쉬운 설명 (ELI5)

Imagine a coat-check attendant who gives you a claim ticket. If you ask for 65,536 tickets, his tiny counter rolls back to 0. He thinks you have zero coats checked, but you still hold the claim stubs. When another customer drops off a priceless jewel, he gives it the claim number 1—and you hand him your duplicate stub, walking out with the crown jewels.

핵심 개념 및 서브시스템 용어 해설

Binder IPC
The primary inter-process communication mechanism in Android, allowing apps and system services to exchange data and handles across process boundaries.
binder_node
The kernel structure representing a remote service or object exposed via Binder.
Reference Count Overflow
Incrementing an integer counter past its maximum value, causing it to wrap around back to zero or negative values.
system_server
The core Android system daemon orchestrating all device permissions, telephony, and window management.

단계별 공격 실행 메커니즘

Step 1

1. Malicious App Initial Access

An untrusted zero-permission Android app opens /dev/binder.

Step 2

2. High-Frequency Transaction Spray

The app repeatedly creates transactional node references until the 32-bit counter wraps around.

Step 3

3. Premature Binder Node Deallocation

The kernel marks the node as unreferenced and frees its slab memory.

Step 4

4. Arbitrary Kernel Code Execution

The app reallocates the memory with a fake function pointer table, hijacking kernel control flow.

소스 코드 비교: 치명적 취약점 vs 보안 강화 패치

일반 개발자가 쉽게 이해할 수 있는 고수준 소스 코드로 제공 (어셈블리/바이너리 제외).

패치되지 않은 취약점
// VULNERABLE: drivers/android/binder.c before patch
static void binder_inc_node_nil(struct binder_node *node) {
    // ROOT CAUSE:
    // Raw unsigned increment without checking for integer overflow saturation!
    node->internal_strong_refs++;
    if (node->internal_strong_refs == 0) {
        // Wrapped around! Node will be prematurely destroyed!
        binder_free_node(node);
    }
}
보안 강화 패치
// SECURE: drivers/android/binder.c patch
static void binder_inc_node_nil(struct binder_node *node) {
    // 1. Enforce atomic saturating reference count arithmetic
    if (unlikely(node->internal_strong_refs == UINT_MAX)) {
        pr_err("binder: strong ref overflow detected, killing task\n");
        binder_user_error("binder: node ref overflow\n");
        return;
    }
    
    // 2. Safely increment verified counter
    node->internal_strong_refs++;
}

엔지니어링 보안 강화 체크리스트

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →