CVE-2023-52609

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix race between mmput() and do_exit()

Task A calls binder_update_page_range() to allocate and insert pages on

a remote address space from Task B. For this, Task A pins the remote mm

via mmget_not_zero() first. This can race with Task B do_exit() and the

final mmput() refcount decrement will come from Task A.

Task A | Task B

------------------+------------------

mmget_not_zero() |

| do_exit()

| exit_mm()

| mmput()

mmput() |

exit_mmap() |

remove_vma() |

fput() |

In this case, the work of ____fput() from Task B is queued up in Task A

as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup

work gets executed. However, Task A instead sleep, waiting for a reply

from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelat

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References