CVE-2023-52438

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix use-after-free in shinker's callback

The mmap read lock is used during the shrinker's callback, which means

that using alloc->vma pointer isn't safe as it can race with munmap().

As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in

munmap") the mmap lock is downgraded after the vma has been isolated.

I was able to reproduce this issue by manually adding some delays and

triggering page reclaiming through the shrinker's debug sysfs. The

following KASAN report confirms the UAF:

==================================================================

BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8

Read of size 8 at addr ffff356ed50e50f0 by task bash/478

CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70

Hardware name: linux,dummy-virt (DT)

Call trace:

zap_page_range_single+0x470/0x4b8

binder_alloc_free_page+0x608/0xadc

__list_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References