CVE-2024-56554

What it actually does

Use-after-free in binder_release_work() where a binder reference is freed while its queued freeze work remains in proc->work, allowing slab access to freed memory during deferred work processing.

Why it matters to the business

Kernel instability, crashes, or potential local privilege escalation on Linux systems using the binder driver, increasing risk of denial of service or compromise on affected devices.

How an attack unfolds

An attacker performs binder operations to allocate a reference and queue freeze work, then triggers reference cleanup without removing the work item; the events workqueue later processes the stale work pointer leading to use-after-free.

How to fix it

Upgrade the Linux kernel to a version containing commit fe39e0ea2d0ba7f508ff453c4c9a44a95ec0de29 or later; ensure any queued freeze work is removed during binder reference cleanup.

How to confirm the fix worked

Verify the running kernel includes the fix commit, recompile with KASAN enabled and confirm absence of slab-use-after-free reports in binder_release_work during binder operations.

Typical attack path

1. Perform binder thread writes to queue freeze work on a reference
2. Trigger binder reference cleanup path without canceling queued work
3. Allow binder_deferred_func to schedule and execute the dangling work item
4. Access freed slab memory during binder_release_work to trigger KASAN-detected UAF

How to detect it

Inspect kernel logs and KASAN reports for slab-use-after-free originating in binder_release_work called from binder_deferred_func; correlate with binder_ioctl activity preceding the crash.

• binder_release_work+0x398/0x3d0
• BUG: KASAN: slab-use-after-free in binder_release_work
• binder_deferred_func+0xb60/0x109c
• Read of size 8 at addr .* by task kworker

What your security team should do

• Prioritize kernel updates containing the binder freeze UAF fix
• Monitor system logs for binder_deferred_func and KASAN UAF signatures
• Restrict untrusted code execution contexts that can access binder ioctl