Abstract

The Binder driver is the foundation of the inter-process communication mechanism in Android. It can be accessed by untrusted applications and isolated processes, making it the most targeted attack surfaces on the Android platform.

Fortunately, with the implementation of multi-dimensional mitigation measures on modern Android phones, the traditional method of exploiting memory corruption vulnerabilities to escalate privileges has become increasingly complex or even unexploitable. In order to obtain arbitrary read/write primitives, it is necessary to master ptmx/file/node techniques and trigger memory corruption multiple times, walking on a path with a very low probability of exploitation.

In this work, we will propose a general exploitation method for recent vulnerabilities in the Binder component (2022, 2023, 2024). Our technique involves constructing a stable path from Binder memory corruption to PageTable memory corruption. By understanding the management method from Binder, we will discuss in depth the impact of various locks and multiple ref counts on exploitation, which ultimately leads to arbitrary physical read/write and universal root.

Finally, we will demonstrate rooting on multiple Android devices and explore some effective vulnerability mitigation strategies for Binder and MMU.