CVE-2024-56553

What it actually does

Memory leak of queued work items in proc->delivered_freeze when a freeze notification is cleared via BC_CLEAR_FREEZE_NOTIFICATION before binder_freeze_notification_done() completes, leaving unreferenced objects that are never freed on process exit.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems using the binder IPC mechanism, potentially leading to degraded performance or denial of service in long-running environments such as Android devices or embedded systems.

How an attack unfolds

An attacker with local access issues repeated binder freeze notification and clear operations through ioctl calls to queue work items that are detached but not freed; over time the accumulated leaked objects consume memory until the process exits without cleanup.

How to fix it

Upgrade the Linux kernel to a version containing commit b8b77712142fb146fe18d2253bc8a798d522e427 or later; apply the patch that frees pending entries in proc->delivered_freeze during binder_deferred_release().

How to confirm the fix worked

Confirm the kernel source contains the fix in binder_deferred_release() and binder_freeze_notification_done(); test by exercising freeze/clear notification sequences and verifying no kmemleak reports for proc->delivered_freeze objects.

Typical attack path

1. Obtain local access to a system running an affected kernel version
2. Use binder_thread_write to issue BC_FREEZE_NOTIFICATION followed by BC_CLEAR_FREEZE_NOTIFICATION
3. Repeat to accumulate unreferenced work items in proc->delivered_freeze
4. Trigger process exit to observe the leak without automatic reclamation

How to detect it

Inspect kernel memory leak reports or kmemleak output for unreferenced objects allocated in binder_thread_write; review binder ioctl traces for sequences of freeze notification and clear commands.

What your security team should do

• Prioritize patching production kernels that include the binder driver
• Monitor for memory growth in processes using binder IPC
• Apply the fixed commit or backport the change to any custom kernels