CVE-2024-56556

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix node UAF in binder_add_freeze_work()

In binder_add_freeze_work() we iterate over the proc->nodes with the

proc->inner_lock held. However, this lock is temporarily dropped in

order to acquire the node->lock first (lock nesting order). This can

race with binder_node_release() and trigger a use-after-free:

==================================================================

BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c

Write of size 4 at addr ffff53c04c29dd04 by task freeze/640

CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17

Hardware name: linux,dummy-virt (DT)

Call trace:

_raw_spin_lock+0xe4/0x19c

binder_add_freeze_work+0x148/0x478

binder_ioctl+0x1e70/0x25ac

__arm64_sys_ioctl+0x124/0x190

Allocated by task 637:

__kmalloc_cache_noprof+0x12c/0x27c

binder_new_node+0x50/0x700

binder_transaction+0x35ac/0x6f74

binder_thread_write+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References