CVE-2024-56554

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix freeze UAF in binder_release_work()

When a binder reference is cleaned up, any freeze work queued in the

associated process should also be removed. Otherwise, the reference is

freed while its ref->freeze.work is still queued in proc->work leading

to a use-after-free issue as shown by the following KASAN report:

==================================================================

BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0

Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211

CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22

Hardware name: linux,dummy-virt (DT)

Workqueue: events binder_deferred_func

Call trace:

binder_release_work+0x398/0x3d0

binder_deferred_func+0xb60/0x109c

process_one_work+0x51c/0xbd4

worker_thread+0x608/0xee8

Allocated by task 703:

__kmalloc_cache_noprof+0x130/0x280

binder_thread_w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References