CVE-2024-46740: Android Linux Kernel Binder Out of Bounds Write Vulnerability
Summary
CVE-2024-46740: In binder_transaction of binder.c, there is a possible out of bounds write due to a missing bounds check. Affects :linux_kernel: versions >= :0, < :2024-11-05. Fixed in :2024-11-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2024-46740 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Linux Kernel is a core component of the Android operating system, responsible for managing hardware resources and facilitating communication between software and hardware. The binder subsystem is crucial for inter-process communication, allowing different applications to interact with each other. This vulnerability arises from a missing bounds check in the binder_transaction function, which can lead to serious security implications.
Vulnerability Detail
In the binder_transaction function of binder.c, a potential out of bounds write occurs due to a lack of proper bounds checking. This vulnerability can be exploited locally to escalate privileges without requiring additional execution permissions. The absence of user interaction for exploitation makes this vulnerability particularly concerning, as it can be triggered by malicious applications running on the same device.
How To Fix
Minimum fixed version
:2024-11-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch by updating the kernel as mentioned above.
Conclusion
CVE-2024-46740 represents a critical vulnerability in the Android Linux Kernel that could allow local privilege escalation due to an out of bounds write in the binder subsystem. It is essential for users to update their systems to the patched version to mitigate this risk.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2024-46740 is a vulnerability in the Android Linux Kernel that allows for a potential out of bounds write, which can lead to local privilege escalation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary risk is local privilege escalation, which could allow an attacker to gain unauthorized access to sensitive system resources or data.
No, user interaction is not required for exploitation, making it a significant security concern.
You can update your Android Linux Kernel by going to your device's settings, selecting 'System', and then 'System updates' to check for and install the latest updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
