{"id":"CVE-2021-46935","state":"PUBLISHED","title":"binder: fix async_free_space accounting for empty parcels","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix async_free_space accounting for empty parcels\n\nIn 4.13, commit 74310e06be4d (\"android: binder: Move buffer out of area shared with user space\")\nfixed a kernel structure visibility issue. As part of that patch,\nsizeof(void *) was used as the buffer size for 0-length data payloads so\nthe driver could detect abusive clients sending 0-length asynchronous\ntransactions to a server by enforcing limits on async_free_size.\n\nUnfortunately, on the \"free\" side, the accounting of async_free_space\ndid not add the sizeof(void *) back. The result was that up to 8-bytes of\nasync_free_space were leaked on every async transaction of 8-bytes or\nless.  These small transactions are uncommon, so this accounting issue\nhas gone undetected for several years.\n\nThe fix is to use \"buffer_size\" (the allocated buffer size) instead of\n\"size\" (the logical buffer size) when updating the async_free_space\nduring the free operation. These are the same except for this\ncorner case of asynchronous transactions with payloads < 8 bytes.","publishedAt":"2024-02-27T09:44:02.071Z","updatedAt":"2026-05-11T13:44:45.123Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"2d2df539d05205fd83c404d5f2dff48d36f9b495","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"7c7064402609aeb6fb11be1b4ec10673ff17b593","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"103b16a8c51f96d5fe063022869ea906c256e5da","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"cfd0d84ba28c18b531648c9d4a35ecca89ad9901","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder_alloc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.14","versionType":"semver"},{"version":"4.14.261","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.224","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.170","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.90","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.13","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder_alloc.c"]}],"references":["https://git.kernel.org/stable/c/2d2df539d05205fd83c404d5f2dff48d36f9b495","https://git.kernel.org/stable/c/7c7064402609aeb6fb11be1b4ec10673ff17b593","https://git.kernel.org/stable/c/103b16a8c51f96d5fe063022869ea906c256e5da","https://git.kernel.org/stable/c/1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4","https://git.kernel.org/stable/c/17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff","https://git.kernel.org/stable/c/cfd0d84ba28c18b531648c9d4a35ecca89ad9901"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:16.371Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/46xxx/CVE-2021-46935.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-46935","state":"PUBLISHED","datePublished":"2024-02-27T09:44:02.071Z","dateUpdated":"2026-05-11T13:44:45.123Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-25T13:45:52.720Z"},"containers":{"cna":{"title":"binder: fix async_free_space accounting for empty parcels","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix async_free_space accounting for empty parcels\n\nIn 4.13, commit 74310e06be4d (\"android: binder: Move buffer out of area shared with user space\")\nfixed a kernel structure visibility issue. As part of that patch,\nsizeof(void *) was used as the buffer size for 0-length data payloads so\nthe driver could detect abusive clients sending 0-length asynchronous\ntransactions to a server by enforcing limits on async_free_size.\n\nUnfortunately, on the \"free\" side, the accounting of async_free_space\ndid not add the sizeof(void *) back. The result was that up to 8-bytes of\nasync_free_space were leaked on every async transaction of 8-bytes or\nless.  These small transactions are uncommon, so this accounting issue\nhas gone undetected for several years.\n\nThe fix is to use \"buffer_size\" (the allocated buffer size) instead of\n\"size\" (the logical buffer size) when updating the async_free_space\nduring the free operation. These are the same except for this\ncorner case of asynchronous transactions with payloads < 8 bytes."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"2d2df539d05205fd83c404d5f2dff48d36f9b495","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"7c7064402609aeb6fb11be1b4ec10673ff17b593","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"103b16a8c51f96d5fe063022869ea906c256e5da","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff","versionType":"git"},{"version":"74310e06be4d74dcf67cd108366710dee5c576d5","status":"affected","lessThan":"cfd0d84ba28c18b531648c9d4a35ecca89ad9901","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder_alloc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.14","versionType":"semver"},{"version":"4.14.261","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.224","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.170","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.90","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.13","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder_alloc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2d2df539d05205fd83c404d5f2dff48d36f9b495"},{"url":"https://git.kernel.org/stable/c/7c7064402609aeb6fb11be1b4ec10673ff17b593"},{"url":"https://git.kernel.org/stable/c/103b16a8c51f96d5fe063022869ea906c256e5da"},{"url":"https://git.kernel.org/stable/c/1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4"},{"url":"https://git.kernel.org/stable/c/17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff"},{"url":"https://git.kernel.org/stable/c/cfd0d84ba28c18b531648c9d4a35ecca89ad9901"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T13:44:45.123Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"4.14.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"4.19.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.4.170"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.10.90"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.15.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-46935","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-02-27T20:52:57.585284Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-05T17:22:03.611Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/2d2df539d05205fd83c404d5f2dff48d36f9b495","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/7c7064402609aeb6fb11be1b4ec10673ff17b593","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/103b16a8c51f96d5fe063022869ea906c256e5da","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1cb8444f3114f0bb2f6e3bcadcf09aa4a28425d4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/17691bada6b2f1d5f1c0f6d28cd9d0727023b0ff","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/cfd0d84ba28c18b531648c9d4a35ecca89ad9901","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:17:43.010Z"}}]}}}