CVE-2024-46740

What it actually does

The vulnerability allows a raw data copy in binder transactions to exceed the data section size and overwrite the offsets array. This corrupts object indexing so that error unwinding decrements arbitrary binder nodes, freeing them while other references still exist and producing a use-after-free.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or escalate privileges, risking data exposure, service disruption, and potential ransomware deployment on servers, containers, and embedded devices that rely on the binder IPC mechanism.

How an attack unfolds

An attacker invokes binder_thread_write with a crafted transaction containing raw data larger than the declared data section. The missing bounds check overwrites offsets, causing subsequent error handling in binder_free_buf to release arbitrary nodes. The resulting dangling pointers are later dereferenced, yielding a use-after-free that can be turned into code execution. Public reports reference exploitation activity by espionage and financially motivated actors in 2024 zero-day campaigns against Linux kernel components.

How to fix it

Upgrade the Linux kernel to version 5.4.284 or later, or apply commit 5a32bfd23022ffa7e152f273fa3fa29befb7d929. Rebuild and reboot all affected hosts; prioritize systems that expose binder to untrusted local processes.

How to confirm the fix worked

Verify the running kernel version contains the fix, confirm the patch is present in the binder transaction copy logic, and run the original KASAN reproducer to ensure no use-after-free is reported.

Typical attack path

1. Obtain local access to a system running a vulnerable Linux kernel
2. Open /dev/binder and prepare a malicious transaction buffer with oversized raw data between objects
3. Issue binder_thread_write ioctl that triggers the out-of-bounds copy and offsets corruption
4. Force an error path that unwinds using the corrupted offsets, freeing arbitrary nodes
5. Reuse the dangling pointers to achieve use-after-free and escalate privileges or crash the kernel

How to detect it

Search kernel logs and KASAN reports for binder_free_buf, binder_thread_write, and slab-use-after-free messages referencing binder nodes. Correlate with process names invoking binder ioctl calls and look for transaction buffers that trigger early error unwinding.

• BUG: KASAN: slab-use-after-free in _raw_spin_lock
• binder_free_buf+0x128/0x434
• binder_thread_write+0x8a4/0x3260
• binder_new_node+0x50/0x700

What your security team should do

• Immediately schedule kernel upgrades to 5.4.284+ on all production and edge Linux systems
• Restrict local access to /dev/binder where feasible until patches are deployed
• Monitor EPSS and threat-intel feeds for any rise in public exploits targeting this class of binder flaw
• Include the fix in the next maintenance window for high-value or internet-facing hosts