CVE-2024-56556 — Race Condition in Linux
Severity
7.0HIGHNVD
EPSS
0.0%
top 98.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 27
Latest updateApr 1
Description
In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
Write of size 4 at addr ffff53c04c29dd04 by task fr…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9
Affected Packages5 packages
▶CVEListV5linux/linuxd579b04a52a183db47dfcb7a44304d7747d551e1 — 38fbefeb2c140b581ed7de8117a5c90d6dd89c22+2
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-wccj-rqrc-g885: In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we↗2024-12-27
OSV▶
CVE-2024-56556: In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we it↗2024-12-27