CVE-2024-56556
published 2024-12-27CVE-2024-56556: In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we iterate…
PriorityP430high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.15%
4.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
Write of size 4 at addr ffff53c04c29dd04 by task freeze/640
CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x19c
binder_add_freeze_work+0x148/0x478
binder_ioctl+0x1e70/0x25ac
__arm64_sys_ioctl+0x124/0x190
Allocated by task 637:
__kmalloc_cache_noprof+0x12c/0x27c
binder_new_node+0x50/0x700
binder_transaction+0x35ac/0x6f74
binder_thread_write+0xfb8/0x42a0
binder_ioctl+0x18f0/0x25ac
__arm64_sys_ioctl+0x124/0x190
Freed by task 637:
kfree+0xf0/0x330
binder_thread_read+0x1e88/0x3a68
binder_ioctl+0x16d8/0x25ac
__arm64_sys_ioctl+0x124/0x190
Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.5-1 (forky) | linux 6.12.5-1 (forky) |
| android | — | — | |
| linux | linux | — | — |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < 38fbefeb2c140b581ed7de8117a5c90d6dd89c22 | 38fbefeb2c140b581ed7de8117a5c90d6dd89c22 |
| linux | linux | >= d579b04a52a183db47dfcb7a44304d7747d551e1 < dc8aea47b928cc153b591b3558829ce42f685074 | dc8aea47b928cc153b591b3558829ce42f685074 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 0 < 6.12.5-1 | 6.12.5-1 |
| linux | linux_kernel | >= 6.12 < 6.12.4 | 6.12.4 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0LOW
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Android
CVE-2024-56556: Binder
vendor_android·2025-04-01·CVSS 7.0
CVE-2024-56556 [HIGH] CVE-2024-56556: Binder
Android Security Bulletin 2025-04-01
CVE: CVE-2024-56556
Severity: HIGH
Type: EoP
Component: Binder
References: A-380855429
Upstream kernel
[2]
Red Hat
kernel: binder: fix node UAF in binder_add_freeze_work()
vendor_redhat·2024-12-27·CVSS 7.0
CVE-2024-56556 [HIGH] kernel: binder: fix node UAF in binder_add_freeze_work()
kernel: binder: fix node UAF in binder_add_freeze_work()
In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
Write of size 4 at addr ffff53c04c29dd04 by task freeze/640
CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x19c
binder_add_freeze_work+0x148/0x478
binder_ioctl+0x1e70/0x25ac
__arm64_sys_ioctl+0x
Debian
CVE-2024-56556: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
vendor_debian·2024·CVSS 7.0
CVE-2024-56556 [HIGH] CVE-2024-56556: linux - In the Linux kernel, the following vulnerability has been resolved: binder: fix...
In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped in order to acquire the node->lock first (lock nesting order). This can race with binder_node_release() and trigger a use-after-free: ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff53c04c29dd04 by task freeze/640 CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_add_freeze_work+0x148/0x478 binder_ioctl+0x1e70/0x25ac __arm64_sys
VulDB
Linux Kernel up to 6.12.3 binder_add_freeze_work use after free (Nessus ID 246665 / WID-SEC-2024-3762)
vuldb·2026-08-03·CVSS 7.0
CVE-2024-56556 [HIGH] Linux Kernel up to 6.12.3 binder_add_freeze_work use after free (Nessus ID 246665 / WID-SEC-2024-3762)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.12.3. Affected by this vulnerability is the function binder_add_freeze_work. The manipulation leads to use after free.
This vulnerability is uniquely identified as CVE-2024-56556. The attack can only be initiated within the local network. No exploit exists.
You should upgrade the affected component.
OSV
CVE-2024-56556: In binder_add_freeze_work of binder
osv·2025-04-01
CVE-2024-56556 CVE-2024-56556: In binder_add_freeze_work of binder
In binder_add_freeze_work of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
GHSA
GHSA-wccj-rqrc-g885: In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we
ghsa_unreviewed·2024-12-27
CVE-2024-56556 [HIGH] CWE-362 GHSA-wccj-rqrc-g885: In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we
In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
Write of size 4 at addr ffff53c04c29dd04 by task freeze/640
CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x19c
binder_add_freeze_work+0x148/0x478
binder_ioctl+0x1e70/0x25ac
__arm64_sys_ioctl+0x124/0x190
Allocated by task 637:
__kmalloc_cache_nopr
OSV
CVE-2024-56556: In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we it
osv·2024-12-27·CVSS 7.0
CVE-2024-56556 [HIGH] CVE-2024-56556: In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we it
In the Linux kernel, the following vulnerability has been resolved: binder: fix node UAF in binder_add_freeze_work() In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped in order to acquire the node->lock first (lock nesting order). This can race with binder_node_release() and trigger a use-after-free: ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff53c04c29dd04 by task freeze/640 CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_add_freeze_work+0x148/0x478 binder_ioctl+0x1e70/0x25ac __arm64_sys
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-27
Published