CVE-2024-56555

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix OOB in binder_add_freeze_work()

In binder_add_freeze_work() we iterate over the proc->nodes with the

proc->inner_lock held. However, this lock is temporarily dropped to

acquire the node->lock first (lock nesting order). This can race with

binder_deferred_release() which removes the nodes from the proc->nodes

rbtree and adds them into binder_dead_nodes list. This leads to a broken

iteration in binder_add_freeze_work() as rb_next() will use data from

binder_dead_nodes, triggering an out-of-bounds access:

==================================================================

BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124

Read of size 8 at addr ffffcb84285f7170 by task freeze/660

CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18

Hardware name: linux,dummy-virt (DT)

Call trace:

rb_next+0xfc/0x124

binder_add_freeze_work+0x344/0x534

binder_ioctl+0x1e70/0x25

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References