{"id":"CVE-2024-56556","state":"PUBLISHED","title":"binder: fix node UAF in binder_add_freeze_work()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix node UAF in binder_add_freeze_work()\n\nIn binder_add_freeze_work() we iterate over the proc->nodes with the\nproc->inner_lock held. However, this lock is temporarily dropped in\norder to acquire the node->lock first (lock nesting order). This can\nrace with binder_node_release() and trigger a use-after-free:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\n  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640\n\n  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   _raw_spin_lock+0xe4/0x19c\n   binder_add_freeze_work+0x148/0x478\n   binder_ioctl+0x1e70/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n\n  Allocated by task 637:\n   __kmalloc_cache_noprof+0x12c/0x27c\n   binder_new_node+0x50/0x700\n   binder_transaction+0x35ac/0x6f74\n   binder_thread_write+0xfb8/0x42a0\n   binder_ioctl+0x18f0/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n\n  Freed by task 637:\n   kfree+0xf0/0x330\n   binder_thread_read+0x1e88/0x3a68\n   binder_ioctl+0x16d8/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n  ==================================================================\n\nFix the race by taking a temporary reference on the node before\nreleasing the proc->inner lock. This ensures the node remains alive\nwhile in use.","publishedAt":"2024-12-27T14:23:02.556Z","updatedAt":"2026-08-05T11:45:03.890Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"38fbefeb2c140b581ed7de8117a5c90d6dd89c22","versionType":"git"},{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"dc8aea47b928cc153b591b3558829ce42f685074","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.4","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]}],"references":["https://git.kernel.org/stable/c/38fbefeb2c140b581ed7de8117a5c90d6dd89c22","https://git.kernel.org/stable/c/dc8aea47b928cc153b591b3558829ce42f685074"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56556.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56556","state":"PUBLISHED","datePublished":"2024-12-27T14:23:02.556Z","dateUpdated":"2026-08-05T11:45:03.890Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:05.991Z"},"containers":{"cna":{"title":"binder: fix node UAF in binder_add_freeze_work()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix node UAF in binder_add_freeze_work()\n\nIn binder_add_freeze_work() we iterate over the proc->nodes with the\nproc->inner_lock held. However, this lock is temporarily dropped in\norder to acquire the node->lock first (lock nesting order). This can\nrace with binder_node_release() and trigger a use-after-free:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\n  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640\n\n  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   _raw_spin_lock+0xe4/0x19c\n   binder_add_freeze_work+0x148/0x478\n   binder_ioctl+0x1e70/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n\n  Allocated by task 637:\n   __kmalloc_cache_noprof+0x12c/0x27c\n   binder_new_node+0x50/0x700\n   binder_transaction+0x35ac/0x6f74\n   binder_thread_write+0xfb8/0x42a0\n   binder_ioctl+0x18f0/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n\n  Freed by task 637:\n   kfree+0xf0/0x330\n   binder_thread_read+0x1e88/0x3a68\n   binder_ioctl+0x16d8/0x25ac\n   __arm64_sys_ioctl+0x124/0x190\n  ==================================================================\n\nFix the race by taking a temporary reference on the node before\nreleasing the proc->inner lock. This ensures the node remains alive\nwhile in use."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"38fbefeb2c140b581ed7de8117a5c90d6dd89c22","versionType":"git"},{"version":"d579b04a52a183db47dfcb7a44304d7747d551e1","status":"affected","lessThan":"dc8aea47b928cc153b591b3558829ce42f685074","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.4","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/38fbefeb2c140b581ed7de8117a5c90d6dd89c22"},{"url":"https://git.kernel.org/stable/c/dc8aea47b928cc153b591b3558829ce42f685074"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the BINDER_FREEZE ioctl on a local binder device file (/dev/binder or binderfs); it is a local IPC driver with no network exposure.\nAC:L - This is a race the attacker fully controls — one thread issues BINDER_FREEZE while other attacker threads free the target node in the unlocked window; it is retryable and sprayable so success is reliable.\nPR:L - BINDER_FREEZE has no capability check; any unprivileged local process with an open binder fd (e.g. any Android app) can reach the code, requiring only basic user access.\nUI:N - The attacker triggers both the freeze operation and the racing node free entirely from its own threads/processes with no victim action required.\nS:U - The use-after-free corrupts kernel slab memory within the kernel's own security authority; there is no crossing of a VM/IOMMU boundary.\nC:H - A use-after-free on the binder_node object lets the attacker reallocate and control the freed slab contents, enabling arbitrary kernel memory disclosure.\nI:H - The UAF provides a write into freed memory that, via heap spraying, yields an arbitrary-write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - The use-after-free reliably corrupts kernel memory and causes kernel panic/oops, resulting in full loss of availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:45:03.890Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-56556","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-10T17:12:44.371493Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-10T17:21:08.457Z"}}]}}}