{"id":"CVE-2024-56555","state":"PUBLISHED","title":"binder: fix OOB in binder_add_freeze_work()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix OOB in binder_add_freeze_work()\n\nIn binder_add_freeze_work() we iterate over the proc->nodes with the\nproc->inner_lock held. However, this lock is temporarily dropped to\nacquire the node->lock first (lock nesting order). This can race with\nbinder_deferred_release() which removes the nodes from the proc->nodes\nrbtree and adds them into binder_dead_nodes list. This leads to a broken\niteration in binder_add_freeze_work() as rb_next() will use data from\nbinder_dead_nodes, triggering an out-of-bounds access:\n\n  ==================================================================\n  BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124\n  Read of size 8 at addr ffffcb84285f7170 by task freeze/660\n\n  CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   rb_next+0xfc/0x124\n   binder_add_freeze_work+0x344/0x534\n   binder_ioctl+0x1e70/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n\n  The buggy address belongs to the variable:\n   binder_dead_nodes+0x10/0x40\n  [...]\n  ==================================================================\n\nThis is possible because proc->nodes (rbtree) and binder_dead_nodes\n(list) share entries in binder_node through a union:\n\n\tstruct binder_node {\n\t[...]\n\t\tunion {\n\t\t\tstruct rb_node rb_node;\n\t\t\tstruct hlist_node dead_node;\n\t\t};\n\nFix the race by checking that the proc is still alive. If not, simply\nbreak out of the iteration.","publishedAt":"2024-12-27T14:23:01.650Z","updatedAt":"2026-08-05T11:45:02.793Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"6b1be1da1f8279cf091266e71b5153c5b02aaff6","versionType":"git"},{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"011e69a1b23011c0db3af4b8293fdd4522cc97b0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.4","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]}],"references":["https://git.kernel.org/stable/c/6b1be1da1f8279cf091266e71b5153c5b02aaff6","https://git.kernel.org/stable/c/011e69a1b23011c0db3af4b8293fdd4522cc97b0"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56555.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56555","state":"PUBLISHED","datePublished":"2024-12-27T14:23:01.650Z","dateUpdated":"2026-08-05T11:45:02.793Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:05.990Z"},"containers":{"cna":{"title":"binder: fix OOB in binder_add_freeze_work()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix OOB in binder_add_freeze_work()\n\nIn binder_add_freeze_work() we iterate over the proc->nodes with the\nproc->inner_lock held. However, this lock is temporarily dropped to\nacquire the node->lock first (lock nesting order). This can race with\nbinder_deferred_release() which removes the nodes from the proc->nodes\nrbtree and adds them into binder_dead_nodes list. This leads to a broken\niteration in binder_add_freeze_work() as rb_next() will use data from\nbinder_dead_nodes, triggering an out-of-bounds access:\n\n  ==================================================================\n  BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124\n  Read of size 8 at addr ffffcb84285f7170 by task freeze/660\n\n  CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   rb_next+0xfc/0x124\n   binder_add_freeze_work+0x344/0x534\n   binder_ioctl+0x1e70/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n\n  The buggy address belongs to the variable:\n   binder_dead_nodes+0x10/0x40\n  [...]\n  ==================================================================\n\nThis is possible because proc->nodes (rbtree) and binder_dead_nodes\n(list) share entries in binder_node through a union:\n\n\tstruct binder_node {\n\t[...]\n\t\tunion {\n\t\t\tstruct rb_node rb_node;\n\t\t\tstruct hlist_node dead_node;\n\t\t};\n\nFix the race by checking that the proc is still alive. If not, simply\nbreak out of the iteration."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"6b1be1da1f8279cf091266e71b5153c5b02aaff6","versionType":"git"},{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"011e69a1b23011c0db3af4b8293fdd4522cc97b0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.4","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6b1be1da1f8279cf091266e71b5153c5b02aaff6"},{"url":"https://git.kernel.org/stable/c/011e69a1b23011c0db3af4b8293fdd4522cc97b0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the BINDER_FREEZE ioctl on an open /dev/binder (or binderfs) file descriptor, which requires local access to the system. There is no network or adjacent-network path to binder IPC.\nAC:L - Although this is a race between binder_add_freeze_work() and binder_deferred_release(), the attacker controls both sides — it creates the victim binder proc, has a peer process hold refs on its nodes, closes the fd to trigger deferred release, and simultaneously loops BINDER_FREEZE on that pid from another thread. The race can be retried indefinitely with no attacker-uncontrollable precondition.\nPR:L - No capability check, uid check, or LSM hook exists on the BINDER_FREEZE path; any process that can open the binder device can freeze any pid found in the global binder_procs list. On Android /dev/binder is world-accessible to every untrusted app, and on desktop/ChromeOS deployments with the binder module (waydroid/anbox/ARC) binderfs is reachable by ordinary users.\nUI:N - Exploitation is driven entirely by the attacker's own processes issuing ioctls and closing file descriptors. No victim action of any kind is needed.\nS:U - The corruption occurs in kernel memory and yields kernel-privilege escalation within the same security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The broken iteration reads out of bounds past the global binder_dead_nodes into adjacent kernel globals (binder_debugfs_dir_entry_root), then chases those kernel pointers through arbitrary objects, disclosing and acting on kernel memory contents and defeating KASLR. This is an unbounded pointer-chasing read, not a small bounded leak.\nI:H - The out-of-bounds result is rb_entry()'d into a struct binder_node * and then written through — tmp_refs increment, spin_lock acquisition, ref->freeze->work.type assignment, and list_add() into ref->proc->todo, plus a refcount decrement via binder_put_node(). This type confusion supplies wild-write primitives on attacker-groomable kernel memory, suitable for control-flow hijacking.\nA:H - In practice the iteration dereferences garbage pointers and takes spinlocks on non-lock memory, producing an immediate KASAN-reported oops, panic, or deadlock. The condition is trivially and repeatedly triggerable by an unprivileged local process."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:45:02.793Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-56555","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T20:02:16.414215Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T20:07:16.206Z"}}]}}}