CVE-2024-56554
published 2024-12-27CVE-2024-56554: In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binder_release_work() When a binder reference is cleaned up, any…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
binder: fix freeze UAF in binder_release_work()
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:
BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211
CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
binder_release_work+0x398/0x3d0
binder_deferred_func+0xb60/0x109c
process_one_work+0x51c/0xbd4
worker_thread+0x608/0xee8
Allocated by task 703:
__kmalloc_cache_noprof+0x130/0x280
binder_thread_write+0xdb4/0x42a0
binder_ioctl+0x18f0/0x25ac
__arm64_sys_ioctl+0x124/0x190
invoke_syscall+0x6c/0x254
Freed by task 211:
kfree+0xc4/0x230
binder_deferred_func+0xae8/0x109c
process_one_work+0x51c/0xbd4
worker_thread+0x608/0xee8
This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.5-1 (forky) | linux 6.12.5-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < fe39e0ea2d0ba7f508ff453c4c9a44a95ec0de29 | fe39e0ea2d0ba7f508ff453c4c9a44a95ec0de29 |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < 7e20434cbca814cb91a0a261ca0106815ef48e5f | 7e20434cbca814cb91a0a261ca0106815ef48e5f |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 6.12 < 6.12.4 | 6.12.4 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: binder: fix freeze UAF in binder_release_work()
vendor_redhat·2024-12-27·CVSS 7.8
CVE-2024-56554 [HIGH] CWE-416 kernel: binder: fix freeze UAF in binder_release_work()
kernel: binder: fix freeze UAF in binder_release_work()
In the Linux kernel, the following vulnerability has been resolved:
binder: fix freeze UAF in binder_release_work()
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:
BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211
CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
binder_release_work+0x398/0x3d0
binder_defe
Debian
CVE-2024-56554: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
vendor_debian·2024·CVSS 7.8
CVE-2024-56554 [HIGH] CVE-2024-56554: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binder_release_work() When a binder reference is cleaned up, any freeze work queued in the associated process should also be removed. Otherwise, the reference is freed while its ref->freeze.work is still queued in proc->work leading to a use-after-free issue as shown by the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0 Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211 CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: binder_release_work+0x398/0x3d0 b
VulDB
Linux Kernel up to 6.12.3 binder_release_work use after free (Nessus ID 246873 / WID-SEC-2024-3762)
vuldb·2026-08-03·CVSS 7.8
CVE-2024-56554 [HIGH] Linux Kernel up to 6.12.3 binder_release_work use after free (Nessus ID 246873 / WID-SEC-2024-3762)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.3. Affected is the function binder_release_work. Executing a manipulation can lead to use after free.
This vulnerability is handled as CVE-2024-56554. The attack can only be done within the local network. There is not any exploit available.
It is advisable to upgrade the affected component.
OSV
CVE-2024-56554: In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binder_release_work() When a binder reference is cleaned
osv·2024-12-27·CVSS 7.8
CVE-2024-56554 [HIGH] CVE-2024-56554: In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binder_release_work() When a binder reference is cleaned
In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binder_release_work() When a binder reference is cleaned up, any freeze work queued in the associated process should also be removed. Otherwise, the reference is freed while its ref->freeze.work is still queued in proc->work leading to a use-after-free issue as shown by the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0 Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211 CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: binder_release_work+0x398/0x3d0 b
GHSA
GHSA-983j-f2fq-2775: In the Linux kernel, the following vulnerability has been resolved:
binder: fix freeze UAF in binder_release_work()
When a binder reference is clean
ghsa_unreviewed·2024-12-27
CVE-2024-56554 [HIGH] CWE-416 GHSA-983j-f2fq-2775: In the Linux kernel, the following vulnerability has been resolved:
binder: fix freeze UAF in binder_release_work()
When a binder reference is clean
In the Linux kernel, the following vulnerability has been resolved:
binder: fix freeze UAF in binder_release_work()
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:
BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211
CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
binder_release_work+0x398/0x3d0
binder_deferred_func+0xb60/0x109c
process_one_work+0x51c/0xbd4
w
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-27
Published