CVE-2024-56555
published 2024-12-27CVE-2024-56555: In the Linux kernel, the following vulnerability has been resolved: binder: fix OOB in binder_add_freeze_work() In binder_add_freeze_work() we iterate over the…
PriorityP430high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.21%
11.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
binder: fix OOB in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:
BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
Read of size 8 at addr ffffcb84285f7170 by task freeze/660
CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
Hardware name: linux,dummy-virt (DT)
Call trace:
rb_next+0xfc/0x124
binder_add_freeze_work+0x344/0x534
binder_ioctl+0x1e70/0x25ac
__arm64_sys_ioctl+0x124/0x190
The buggy address belongs to the variable:
binder_dead_nodes+0x10/0x40
[...]
This is possible because proc->nodes (rbtree) and binder_dead_nodes
(list) share entries in binder_node through a union:
struct binder_node {
[...]
union {
struct rb_node rb_node;
struct hlist_node dead_node;
};
Fix the race by checking that the proc is still alive. If not, simply
break out of the iteration.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.5-1 (forky) | linux 6.12.5-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < 6b1be1da1f8279cf091266e71b5153c5b02aaff6 | 6b1be1da1f8279cf091266e71b5153c5b02aaff6 |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < 011e69a1b23011c0db3af4b8293fdd4522cc97b0 | 011e69a1b23011c0db3af4b8293fdd4522cc97b0 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 6.12 < 6.12.4 | 6.12.4 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1LOW
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.3 binder_add_freeze_work out-of-bounds (WID-SEC-2024-3762)
vuldb·2026-08-03·CVSS 7.1
CVE-2024-56555 [HIGH] Linux Kernel up to 6.12.3 binder_add_freeze_work out-of-bounds (WID-SEC-2024-3762)
A vulnerability has been found in Linux Kernel up to 6.12.3 and classified as problematic. This vulnerability affects the function binder_add_freeze_work. The manipulation leads to out-of-bounds read.
This vulnerability is listed as CVE-2024-56555. The attack must be carried out from within the local network. There is no available exploit.
The affected component should be upgraded.
GHSA
GHSA-q9f3-jcg6-9j2x: In the Linux kernel, the following vulnerability has been resolved:
binder: fix OOB in binder_add_freeze_work()
In binder_add_freeze_work() we itera
ghsa_unreviewed·2024-12-27
CVE-2024-56555 [HIGH] CWE-125 GHSA-q9f3-jcg6-9j2x: In the Linux kernel, the following vulnerability has been resolved:
binder: fix OOB in binder_add_freeze_work()
In binder_add_freeze_work() we itera
In the Linux kernel, the following vulnerability has been resolved:
binder: fix OOB in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:
BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
Read of size 8 at addr ffffcb84285f7170 by task freeze/660
CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
Hardware name:
OSV
CVE-2024-56555: In the Linux kernel, the following vulnerability has been resolved: binder: fix OOB in binder_add_freeze_work() In binder_add_freeze_work() we iterate
osv·2024-12-27·CVSS 7.1
CVE-2024-56555 [HIGH] CVE-2024-56555: In the Linux kernel, the following vulnerability has been resolved: binder: fix OOB in binder_add_freeze_work() In binder_add_freeze_work() we iterate
In the Linux kernel, the following vulnerability has been resolved: binder: fix OOB in binder_add_freeze_work() In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped to acquire the node->lock first (lock nesting order). This can race with binder_deferred_release() which removes the nodes from the proc->nodes rbtree and adds them into binder_dead_nodes list. This leads to a broken iteration in binder_add_freeze_work() as rb_next() will use data from binder_dead_nodes, triggering an out-of-bounds access: ================================================================== BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124 Read of size 8 at addr ffffcb84285f7170 by task freeze/660 CPU: 8 UID: 0 PID: 660 Comm: fr
Red Hat
kernel: binder: fix OOB in binder_add_freeze_work()
vendor_redhat·2024-12-27·CVSS 7.1
CVE-2024-56555 [HIGH] CWE-125 kernel: binder: fix OOB in binder_add_freeze_work()
kernel: binder: fix OOB in binder_add_freeze_work()
In the Linux kernel, the following vulnerability has been resolved:
binder: fix OOB in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:
BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
Read of size 8 at addr ffffcb84285f7170 by task freeze/660
CPU: 8 UID: 0 PID: 660 Comm: freeze Not taint
Debian
CVE-2024-56555: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
vendor_debian·2024·CVSS 7.1
CVE-2024-56555 [HIGH] CVE-2024-56555: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
In the Linux kernel, the following vulnerability has been resolved: binder: fix OOB in binder_add_freeze_work() In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped to acquire the node->lock first (lock nesting order). This can race with binder_deferred_release() which removes the nodes from the proc->nodes rbtree and adds them into binder_dead_nodes list. This leads to a broken iteration in binder_add_freeze_work() as rb_next() will use data from binder_dead_nodes, triggering an out-of-bounds access: ================================================================== BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124 Read of size 8 at addr ffffcb84285f7170 by task freeze/660 CPU: 8 UID: 0 PID: 660 Comm: fr
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-27
Published