CVE-2020-0041

CVE-2020-0041 is an out-of-bounds write in the binder_transaction function of the Android kernel's binder.c, caused by an incorrect bounds check in the binder IPC driver. It is triggered locally: code already on the device, such as an unprivileged app or process, can issue a maliciously crafted binder transaction with no user interaction and no additional execution privileges required. A successful exploit escalates a local attacker from app-level privileges to kernel-level code execution, giving full read/write control of the device — the same type of primitive used by rooting malware seen in recent Android threats. Affected products are Android devices running kernel builds without the upstream binder fix; Google is the listed vendor, and because the flaw sits in the shared Android kernel it potentially spans many OEM device models rather than a single product. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03, indicating known exploitation in the wild, though no public PoC is known and EPSS estimates roughly a 3% chance of exploitation in any 30-day window.

What to do: Apply the kernel/binder patch by installing your device OEM's latest Android security update, consistent with CISA KEV's required action to apply updates per vendor instructions, and verify the device is on a current security patch level. There is no known mitigation short of patching the binder driver, so prioritize devices that install untrusted apps, where local attackers have an execution foothold. The rooting malware activity in recent headlines is not confirmed in this data to exploit CVE-2020-0041, but patching eliminates the kernel LPE primitive such malware relies on.