CVE-2024-56553
published 2024-12-27CVE-2024-56553: In the Linux kernel, the following vulnerability has been resolved: binder: fix memleak of proc->delivered_freeze If a freeze notification is cleared with…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
8.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
binder: fix memleak of proc->delivered_freeze
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:
unreferenced object 0xffff38e8cfa36180 (size 64):
comm "binder-util", pid 655, jiffies 4294936641
hex dump (first 32 bytes):
b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..
0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........] kmemleak_alloc+0x34/0x40
[] __kmalloc_cache_noprof+0x208/0x280
[] binder_thread_write+0xdec/0x439c
[] binder_ioctl+0x1b68/0x22cc
[] __arm64_sys_ioctl+0x124/0x190
[] invoke_syscall+0x6c/0x254
[] el0_svc_common.constprop.0+0xac/0x230
[] do_el0_svc+0x40/0x58
[] el0_svc+0x38/0x78
[] el0t_64_sync_handler+0x120/0x12c
[] el0t_64_sync+0x190/0x194
This patch fixes the leak by ensuring that any pending entries in
proc->delivered_freeze are freed during binder_deferred_release().
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.5-1 (forky) | linux 6.12.5-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < b8b77712142fb146fe18d2253bc8a798d522e427 | b8b77712142fb146fe18d2253bc8a798d522e427 |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < 1db76ec2b4b206ff943e292a0b55e68ff3443598 | 1db76ec2b4b206ff943e292a0b55e68ff3443598 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 6.12 < 6.12.4 | 6.12.4 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: binder: fix memleak of proc->delivered_freeze
vendor_redhat·2024-12-27·CVSS 5.5
CVE-2024-56553 [MEDIUM] CWE-401 kernel: binder: fix memleak of proc->delivered_freeze
kernel: binder: fix memleak of proc->delivered_freeze
In the Linux kernel, the following vulnerability has been resolved:
binder: fix memleak of proc->delivered_freeze
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:
unreferenced object 0xffff38e8cfa36180 (size 64):
comm "binder-util", pid 655, jiffies 4294936641
hex dump (first 32 bytes):
b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..
0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........] kmemleak_alloc+0x34/0x40
[] __kmall
Debian
CVE-2024-56553: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
vendor_debian·2024·CVSS 5.5
CVE-2024-56553 [MEDIUM] CVE-2024-56553: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
In the Linux kernel, the following vulnerability has been resolved: binder: fix memleak of proc->delivered_freeze If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION before calling binder_freeze_notification_done(), then it is detached from its reference (e.g. ref->freeze) but the work remains queued in proc->delivered_freeze. This leads to a memory leak when the process exits as any pending entries in proc->delivered_freeze are not freed: unreferenced object 0xffff38e8cfa36180 (size 64): comm "binder-util", pid 655, jiffies 4294936641 hex dump (first 32 bytes): b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8.. 0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........] kmemleak_alloc+0x34/0x40 [] __kmalloc_cache_noprof+0x208/0x280 [] binder_thread_write+0xde
VulDB
Linux Kernel up to 6.12.3 binder_freeze_notification_done memory leak (Nessus ID 246393 / WID-SEC-2024-3762)
vuldb·2026-08-03·CVSS 5.5
CVE-2024-56553 [MEDIUM] Linux Kernel up to 6.12.3 binder_freeze_notification_done memory leak (Nessus ID 246393 / WID-SEC-2024-3762)
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.12.3. This affects the function binder_freeze_notification_done. Executing a manipulation can lead to memory leak.
This vulnerability is tracked as CVE-2024-56553. The attack is only possible within the local network. No exploit exists.
You should upgrade the affected component.
OSV
CVE-2024-56553: In the Linux kernel, the following vulnerability has been resolved: binder: fix memleak of proc->delivered_freeze If a freeze notification is cleared
osv·2024-12-27·CVSS 5.5
CVE-2024-56553 [MEDIUM] CVE-2024-56553: In the Linux kernel, the following vulnerability has been resolved: binder: fix memleak of proc->delivered_freeze If a freeze notification is cleared
In the Linux kernel, the following vulnerability has been resolved: binder: fix memleak of proc->delivered_freeze If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION before calling binder_freeze_notification_done(), then it is detached from its reference (e.g. ref->freeze) but the work remains queued in proc->delivered_freeze. This leads to a memory leak when the process exits as any pending entries in proc->delivered_freeze are not freed: unreferenced object 0xffff38e8cfa36180 (size 64): comm "binder-util", pid 655, jiffies 4294936641 hex dump (first 32 bytes): b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8.. 0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........] kmemleak_alloc+0x34/0x40 [] __kmalloc_cache_noprof+0x208/0x280 [] binder_thread_write+0xde
GHSA
GHSA-qvfp-2hw2-qffh: In the Linux kernel, the following vulnerability has been resolved:
binder: fix memleak of proc->delivered_freeze
If a freeze notification is cleare
ghsa_unreviewed·2024-12-27
CVE-2024-56553 [MEDIUM] CWE-401 GHSA-qvfp-2hw2-qffh: In the Linux kernel, the following vulnerability has been resolved:
binder: fix memleak of proc->delivered_freeze
If a freeze notification is cleare
In the Linux kernel, the following vulnerability has been resolved:
binder: fix memleak of proc->delivered_freeze
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:
unreferenced object 0xffff38e8cfa36180 (size 64):
comm "binder-util", pid 655, jiffies 4294936641
hex dump (first 32 bytes):
b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..
0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........] kmemleak_alloc+0x34/0x40
[] __kmalloc_cache_noprof+0x208/0x280
[] binder_thread_write+0
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-27
Published