CVE-2014-7911 how is AAdroid.os.BinderProxy cost into android.os.BinderProxy?
<p>In <a href="http://seclists.org/fulldisclosure/2014/Nov/51" rel="nofollow">http://seclists.org/fulldisclosure/2014/Nov/51</a>
Jann Horn write a POC of CVE-2014-7911, using a fake class AAdroid.os.BinderProxy to trigger "finalize()" function of android.os.BinderProxy.
But I'm not sure how is AAdroid.os.BinderProxy cost into android.os.BinderProxy during Binder communication.</p>

<p>Can someone help answer this question?</p>

<p>Also see:
<a href="http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-analysis-android-system-service-vulnerability-exploitation/" rel="nofollow">http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-analysis-android-system-service-vulnerability-exploitation/</a></p>