● CVE-2024-32896 / In-The-Wild Zero-Day

CVE-2024-32896: Android Binder IPC Driver Privilege Escalation Teardown

How an actively exploited transaction descriptor refcount overflow in drivers/android/binder.c allowed malicious apps to escalate to full root privileges.

💡 Простое объяснение на пальцах (ELI5)

Imagine a coat-check attendant who gives you a claim ticket. If you ask for 65,536 tickets, his tiny counter rolls back to 0. He thinks you have zero coats checked, but you still hold the claim stubs. When another customer drops off a priceless jewel, he gives it the claim number 1—and you hand him your duplicate stub, walking out with the crown jewels.

Ключевые концепции и архитектурные термины

Binder IPC
The primary inter-process communication mechanism in Android, allowing apps and system services to exchange data and handles across process boundaries.
binder_node
The kernel structure representing a remote service or object exposed via Binder.
Reference Count Overflow
Incrementing an integer counter past its maximum value, causing it to wrap around back to zero or negative values.
system_server
The core Android system daemon orchestrating all device permissions, telephony, and window management.

Пошаговая механика выполнения атаки

Step 1

1. Malicious App Initial Access

An untrusted zero-permission Android app opens /dev/binder.

Step 2

2. High-Frequency Transaction Spray

The app repeatedly creates transactional node references until the 32-bit counter wraps around.

Step 3

3. Premature Binder Node Deallocation

The kernel marks the node as unreferenced and frees its slab memory.

Step 4

4. Arbitrary Kernel Code Execution

The app reallocates the memory with a fake function pointer table, hijacking kernel control flow.

Исходный код: Уязвимость vs. Исправленный патч

Представлено на понятном высокоуровневом исходном коде (без ассемблера и бинарных дампов).

УЯЗВИМЫЙ КОД ДО ПАТЧА
// VULNERABLE: drivers/android/binder.c before patch
static void binder_inc_node_nil(struct binder_node *node) {
    // ROOT CAUSE:
    // Raw unsigned increment without checking for integer overflow saturation!
    node->internal_strong_refs++;
    if (node->internal_strong_refs == 0) {
        // Wrapped around! Node will be prematurely destroyed!
        binder_free_node(node);
    }
}
БЕЗОПАСНОЕ ИСПРАВЛЕНИЕ
// SECURE: drivers/android/binder.c patch
static void binder_inc_node_nil(struct binder_node *node) {
    // 1. Enforce atomic saturating reference count arithmetic
    if (unlikely(node->internal_strong_refs == UINT_MAX)) {
        pr_err("binder: strong ref overflow detected, killing task\n");
        binder_user_error("binder: node ref overflow\n");
        return;
    }
    
    // 2. Safely increment verified counter
    node->internal_strong_refs++;
}

Инженерный чек-лист для код-ревью и защиты систем

← Полный каталог уязвимостей Все бюллетени безопасности →