CVE-2023-54157

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF of alloc->vma in race with munmap()

[ cmllamas: clean forward port from commit 015ac18be7de ("binder: fix

UAF of alloc->vma in race with munmap()") in 5.10 stable. It is needed

in mainline after the revert of commit a43cfc87caaf ("android: binder:

stop saving a pointer to the VMA") as pointed out by Liam. The commit

log and tags have been tweaked to reflect this. ]

In commit 720c24192404 ("ANDROID: binder: change down_write to

down_read") binder assumed the mmap read lock is sufficient to protect

alloc->vma inside binder_update_page_range(). This used to be accurate

until commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in

munmap"), which now downgrades the mmap_lock after detaching the vma

from the rbtree in munmap(). Then it proceeds to teardown and free the

vma with only the read lock held.

This means that accesses to alloc->vma in binder_update_page_range() now

will race with

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References