CVE-2020-0041

What is binder.c and Why Does It Matter?

Binder is Android's core inter-process communication (IPC) mechanism — nearly every interaction between apps and system services on Android passes through it. A vulnerability in binder.c sits at one of the most privileged and heavily-used chokepoints in the entire OS, making it an especially valuable target for attackers seeking to break out of an app's sandbox.

Overview

CVE-2020-0041 is an out-of-bounds write vulnerability (CWE-20, though commonly categorized alongside CWE-787-style memory corruption) in binder_transaction within binder.c, caused by an incorrect bounds check that allows local privilege escalation (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). It gained significant attention in October 2021 when Lookout published research identifying AbstractEmu, a rooting malware framework that chained this CVE with CVE-2019-2215 (another Binder use-after-free) and CVE-2020-0069 (a MediaTek chipset bug, also enriched on this site) to achieve full device root — distributed through apps available on Google Play and other app stores.

Technical Details

The vulnerability arises from insufficient bounds checking in the Binder driver's transaction-handling code, allowing a local attacker (or a malicious app) to trigger an out-of-bounds write in kernel memory and escalate privileges beyond what the Android app sandbox should permit. Combined with the MediaTek-specific privilege-escalation primitive in CVE-2020-0069, this gave AbstractEmu's operators a broadly applicable rooting capability across a wide range of device models and Android versions.

Discovery

Fixed as part of Android's routine March 2020 security bulletin. The AbstractEmu chaining was documented by Lookout's threat research team in October 2021, when they identified apps in official app stores using this exploit combination to silently root victim devices.

Exploitation Context

AbstractEmu was notable for successfully getting rooting malware into Google Play itself, rather than relying solely on sideloading or third-party app stores — once a device was rooted, the malware gained the ability to bypass Android's permission model entirely, enabling extensive surveillance and data theft. This is a clear example of a privilege-escalation vulnerability chain being weaponized for mass malware distribution rather than narrow targeted attacks.

Remediation

1. Apply the March 2020 Android security patch level or later via your device manufacturer's update mechanism.
2. Only install apps from trusted sources, and be cautious even with apps from official stores like Google Play, since AbstractEmu demonstrated that official app store vetting doesn't guarantee an app is free of rooting exploit chains.
3. Retire devices that no longer receive security updates, since AbstractEmu specifically targeted devices running outdated, unpatched Android versions.
4. Review installed apps for unfamiliar utility, wallpaper, or "cleaner"-style apps — commonly used as delivery vehicles for rooting malware — and consider a factory reset if AbstractEmu-style compromise is suspected.