CVE-2024-56556

What it actually does

Race condition in binder_add_freeze_work() drops proc->inner_lock to acquire node->lock, allowing concurrent binder_node_release() to free the node and trigger use-after-free on subsequent spinlock access.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or attempt privilege escalation, leading to denial of service, data corruption, or full system compromise on servers, desktops, and embedded devices.

How an attack unfolds

An attacker creates binder nodes via transactions, then concurrently invokes freeze operations that race with node release; the temporary lock drop allows the node to be freed before reuse, resulting in KASAN-detected slab use-after-free during spinlock acquisition.

How to fix it

Upgrade the Linux kernel to commit 38fbefeb2c140b581ed7de8117a5c90d6dd89c22 or later; apply vendor backports that hold a temporary node reference before dropping the proc lock.

How to confirm the fix worked

Verify the patch is present by checking for the reference count increment before the inner_lock release in binder_add_freeze_work(); run kernel selftests exercising binder freeze paths under concurrency; confirm absence of KASAN reports mentioning binder_add_freeze_work.

Typical attack path

1. Create binder nodes through transaction writes
2. Trigger concurrent freeze ioctl while nodes are being released
3. Race the inner_lock drop to access freed node memory
4. Exploit resulting UAF for memory corruption or control-flow hijack

How to detect it

Inspect kernel logs for KASAN or slab-use-after-free reports referencing binder_add_freeze_work, binder_ioctl, or _raw_spin_lock during freeze operations; correlate with processes invoking binder freeze ioctls.

• binder_add_freeze_work
• BUG: KASAN: slab-use-after-free in _raw_spin_lock
• binder_node_release

What your security team should do

• Prioritize kernel updates on all systems exposing binder (Android, embedded Linux)
• Monitor for local privilege-escalation attempts via binder ioctls
• Restrict untrusted local code execution until patches are deployed