In the Linux kernel, the following vulnerability has been resolved:
binder: fix race between mmput() and do_exit()
Task A calls binderupdatepagerange() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmgetnotzero() first. This can race with Task B doexit() and the final mmput() refcount decrement will come from Task A.
Task A | Task B ------------------+------------------ mmgetnotzero() | | doexit() | exitmm() | mmput() mmput() | exitmmap() | removevma() | fput() |
In this case, the work of _fput() from Task B is queued up in Task A as TWARESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead).
This means the binderdeferredrelease() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then.
In order to fix this use mmputasync() that will schedule the work in the corresponding mm->asyncput_work WQ instead of Task A.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77d210e8db4d61d43b2d16df66b1ec46fad2ee01",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-0b97adb7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298816596068318408609173928165130744770",
"233370204093231808209623952714788264549",
"228003234587610406079615368018397479810",
"150430215422809349069784146597690125259",
"316231244680482201897367161328683715612",
"233370204093231808209623952714788264549",
"78512177995246938492859169231529238430",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@252a2a5569eb9f8d16428872cc24dea1ac0bb097",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-5c853357",
"digest": {
"threshold": 0.9,
"line_hashes": [
"142101866960204267960158340358440051189",
"155711500106095388442468041619694103810",
"176785944414406117685556059439725336262",
"150430215422809349069784146597690125259",
"269233398191596408431628595980039105734",
"155711500106095388442468041619694103810",
"155627542320958824551943369574616508984",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-73003612",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298816596068318408609173928165130744770",
"233370204093231808209623952714788264549",
"228003234587610406079615368018397479810",
"150430215422809349069784146597690125259",
"316231244680482201897367161328683715612",
"233370204093231808209623952714788264549",
"78512177995246938492859169231529238430",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a9ab0d963621d9d12199df9817e66982582d5a5",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-7d2221cc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298816596068318408609173928165130744770",
"233370204093231808209623952714788264549",
"228003234587610406079615368018397479810",
"150430215422809349069784146597690125259",
"316231244680482201897367161328683715612",
"233370204093231808209623952714788264549",
"78512177995246938492859169231529238430",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6696f76c32ff67fec26823fc2df46498e70d9bf3",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-98e9cef7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298816596068318408609173928165130744770",
"233370204093231808209623952714788264549",
"228003234587610406079615368018397479810",
"150430215422809349069784146597690125259",
"316231244680482201897367161328683715612",
"233370204093231808209623952714788264549",
"78512177995246938492859169231529238430",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95b1d336b0642198b56836b89908d07b9a0c9608",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-bb3681ec",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230016407909867479340718739730270364194",
"255249363209128652042378149899011088016",
"287185270255611045347899216559909706717",
"150430215422809349069784146597690125259",
"279734289526849503204589052341068579992",
"255249363209128652042378149899011088016",
"121431923248073653242092870455803510486",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98fee5bee97ad47b527a997d5786410430d1f0e9",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-d39069c3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298816596068318408609173928165130744770",
"233370204093231808209623952714788264549",
"228003234587610406079615368018397479810",
"150430215422809349069784146597690125259",
"316231244680482201897367161328683715612",
"233370204093231808209623952714788264549",
"78512177995246938492859169231529238430",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e7a0d86542b0ea903006d3f42f33c4f7ead6918",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/android/binder_alloc.c"
},
"id": "CVE-2023-52609-e2823b22",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298816596068318408609173928165130744770",
"233370204093231808209623952714788264549",
"228003234587610406079615368018397479810",
"150430215422809349069784146597690125259",
"316231244680482201897367161328683715612",
"233370204093231808209623952714788264549",
"78512177995246938492859169231529238430",
"75597628134375888673185117777892222341"
]
},
"signature_type": "Line"
}
]