● CVE-2024-32896 / In-The-Wild Zero-Day

CVE-2024-32896: Android Binder IPC Driver Privilege Escalation Teardown

How an actively exploited transaction descriptor refcount overflow in drivers/android/binder.c allowed malicious apps to escalate to full root privileges.

💡 通俗通俗化解析 (ELI5)

Imagine a coat-check attendant who gives you a claim ticket. If you ask for 65,536 tickets, his tiny counter rolls back to 0. He thinks you have zero coats checked, but you still hold the claim stubs. When another customer drops off a priceless jewel, he gives it the claim number 1—and you hand him your duplicate stub, walking out with the crown jewels.

核心概念与底层架构术语

Binder IPC
The primary inter-process communication mechanism in Android, allowing apps and system services to exchange data and handles across process boundaries.
binder_node
The kernel structure representing a remote service or object exposed via Binder.
Reference Count Overflow
Incrementing an integer counter past its maximum value, causing it to wrap around back to zero or negative values.
system_server
The core Android system daemon orchestrating all device permissions, telephony, and window management.

攻击利用全流程逐步拆解

Step 1

1. Malicious App Initial Access

An untrusted zero-permission Android app opens /dev/binder.

Step 2

2. High-Frequency Transaction Spray

The app repeatedly creates transactional node references until the 32-bit counter wraps around.

Step 3

3. Premature Binder Node Deallocation

The kernel marks the node as unreferenced and frees its slab memory.

Step 4

4. Arbitrary Kernel Code Execution

The app reallocates the memory with a fake function pointer table, hijacking kernel control flow.

源码对比：致命缺陷 vs. 加固补丁

采用清晰易读的高级编程语言展示（不含晦涩汇编或二进制机器码）。

未修补缺陷代码
// VULNERABLE: drivers/android/binder.c before patch
static void binder_inc_node_nil(struct binder_node *node) {
    // ROOT CAUSE:
    // Raw unsigned increment without checking for integer overflow saturation!
    node->internal_strong_refs++;
    if (node->internal_strong_refs == 0) {
        // Wrapped around! Node will be prematurely destroyed!
        binder_free_node(node);
    }
}
安全加固补丁
// SECURE: drivers/android/binder.c patch
static void binder_inc_node_nil(struct binder_node *node) {
    // 1. Enforce atomic saturating reference count arithmetic
    if (unlikely(node->internal_strong_refs == UINT_MAX)) {
        pr_err("binder: strong ref overflow detected, killing task\n");
        binder_user_error("binder: node ref overflow\n");
        return;
    }
    
    // 2. Safely increment verified counter
    node->internal_strong_refs++;
}

工程落地与系统加固清单

← 浏览完整安全目录 所有平台安全更新 →