CVE-2024-56553

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix memleak of proc->delivered_freeze

If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION

before calling binder_freeze_notification_done(), then it is detached

from its reference (e.g. ref->freeze) but the work remains queued in

proc->delivered_freeze. This leads to a memory leak when the process

exits as any pending entries in proc->delivered_freeze are not freed:

unreferenced object 0xffff38e8cfa36180 (size 64):

comm "binder-util", pid 655, jiffies 4294936641

hex dump (first 32 bytes):

b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..

0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........<.K.....

backtrace (crc 95983b32):

[<000000000d0582cf>] kmemleak_alloc+0x34/0x40

[<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280

[<00000000313b1704>] binder_thread_write+0xdec/0x439c

[<000000000cbd33bb>] binder_ioctl+0x1b68/0x22c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References