Google Android 4.4 Binder Driver binder_poll use after free

Summaryinfo

A vulnerability identified as critical has been detected in Google Android 4.4. This affects the function binder_poll of the component Binder Driver. The manipulation leads to use after free. This vulnerability is documented as CVE-2019-2215. The attack needs to be performed locally. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Android 4.4 (Smartphone Operating System). It has been rated as critical. This issue affects the function binder_poll of the component Binder Driver. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

The weakness was released 09/27/2019 as confirmed bug report (Website). It is possible to read the advisory at bugs.chromium.org. The identification of this vulnerability is CVE-2019-2215 since 12/10/2018. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The advisory points out:

As described in the upstream commit: “binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free.

After immediately, there has been an exploit disclosed. The exploit is available at bugs.chromium.org. It is declared as attacked. We expect the 0-day to have been worth approximately $5k-$25k. The code used by the exploit is:

#include <fcntl.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define BINDER_THREAD_EXIT 0x40046208ul

int main()
{
		int fd, epfd;
		struct epoll_event event = { .events = EPOLLIN };

		fd = open("/dev/binder0", O_RDONLY);
		epfd = epoll_create(1000);
		epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event);
		ioctl(fd, BINDER_THREAD_EXIT, NULL);
}

Apply updates per vendor instructions.

Upgrading to version 3.8, 4.14 LTS or 4.9 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47463). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 4.4

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #88: Android: Use-After-Free in Binder driver (by misc)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion