180 lines
13 KiB
JSON
180 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-54157",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-24T13:02:52.530Z",
|
|
"datePublished": "2025-12-24T13:07:06.764Z",
|
|
"dateUpdated": "2026-08-05T09:17:43.435Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:17:43.435Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF of alloc->vma in race with munmap()\n\n[ cmllamas: clean forward port from commit 015ac18be7de (\"binder: fix\n UAF of alloc->vma in race with munmap()\") in 5.10 stable. It is needed\n in mainline after the revert of commit a43cfc87caaf (\"android: binder:\n stop saving a pointer to the VMA\") as pointed out by Liam. The commit\n log and tags have been tweaked to reflect this. ]\n\nIn commit 720c24192404 (\"ANDROID: binder: change down_write to\ndown_read\") binder assumed the mmap read lock is sufficient to protect\nalloc->vma inside binder_update_page_range(). This used to be accurate\nuntil commit dd2283f2605e (\"mm: mmap: zap pages with read mmap_sem in\nmunmap\"), which now downgrades the mmap_lock after detaching the vma\nfrom the rbtree in munmap(). Then it proceeds to teardown and free the\nvma with only the read lock held.\n\nThis means that accesses to alloc->vma in binder_update_page_range() now\nwill race with vm_area_free() in munmap() and can cause a UAF as shown\nin the following KASAN trace:\n\n ==================================================================\n BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0\n Read of size 8 at addr ffff16204ad00600 by task server/558\n\n CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n dump_backtrace+0x0/0x2a0\n show_stack+0x18/0x2c\n dump_stack+0xf8/0x164\n print_address_description.constprop.0+0x9c/0x538\n kasan_report+0x120/0x200\n __asan_load8+0xa0/0xc4\n vm_insert_page+0x7c/0x1f0\n binder_update_page_range+0x278/0x50c\n binder_alloc_new_buf+0x3f0/0xba0\n binder_transaction+0x64c/0x3040\n binder_thread_write+0x924/0x2020\n binder_ioctl+0x1610/0x2e5c\n __arm64_sys_ioctl+0xd4/0x120\n el0_svc_common.constprop.0+0xac/0x270\n do_el0_svc+0x38/0xa0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xe8/0x114\n el0_sync+0x180/0x1c0\n\n Allocated by task 559:\n kasan_save_stack+0x38/0x6c\n __kasan_kmalloc.constprop.0+0xe4/0xf0\n kasan_slab_alloc+0x18/0x2c\n kmem_cache_alloc+0x1b0/0x2d0\n vm_area_alloc+0x28/0x94\n mmap_region+0x378/0x920\n do_mmap+0x3f0/0x600\n vm_mmap_pgoff+0x150/0x17c\n ksys_mmap_pgoff+0x284/0x2dc\n __arm64_sys_mmap+0x84/0xa4\n el0_svc_common.constprop.0+0xac/0x270\n do_el0_svc+0x38/0xa0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xe8/0x114\n el0_sync+0x180/0x1c0\n\n Freed by task 560:\n kasan_save_stack+0x38/0x6c\n kasan_set_track+0x28/0x40\n kasan_set_free_info+0x24/0x4c\n __kasan_slab_free+0x100/0x164\n kasan_slab_free+0x14/0x20\n kmem_cache_free+0xc4/0x34c\n vm_area_free+0x1c/0x2c\n remove_vma+0x7c/0x94\n __do_munmap+0x358/0x710\n __vm_munmap+0xbc/0x130\n __arm64_sys_munmap+0x4c/0x64\n el0_svc_common.constprop.0+0xac/0x270\n do_el0_svc+0x38/0xa0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xe8/0x114\n el0_sync+0x180/0x1c0\n\n [...]\n ==================================================================\n\nTo prevent the race above, revert back to taking the mmap write lock\ninside binder_update_page_range(). One might expect an increase of mmap\nlock contention. However, binder already serializes these calls via top\nlevel alloc->mutex. Also, there was no performance impact shown when\nrunning the binder benchmark tests."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached only through local syscalls — `mmap()`, `munmap()`, and `ioctl(BINDER_WRITE_READ)` on an opened `/dev/binder` (or binderfs) character device. There is no remote or adjacent-network path into `binder_update_page_range()`.\nAC:L - The attacker controls both sides of the race entirely within their own process: one thread issues the BC_TRANSACTION ioctl while a second thread calls `munmap()` on the binder mapping. The window is further widened by the sleepable `alloc_page(GFP_KERNEL)` that executes between the `alloc->vma` load and the `vm_insert_page()` dereference, and the attempt is freely repeatable.\nPR:L - No capability check exists anywhere on the path — binder.c contains no `capable()`/`CAP_*` gate reaching `binder_alloc_new_buf()`. An ordinary Android app (`untrusted_app`) may open `/dev/binder`, and on generic kernels binderfs is `FS_USERNS_MOUNT` (binderfs.c:796), so an unprivileged user can `unshare -Ur`, mount binderfs, and create a 0600 binder device they own via `BINDER_CTL_ADD`.\nUI:N - The attacker performs every step — open, mmap, transaction ioctl, and munmap — from their own process with no victim action required.\nS:U - The corruption occurs in kernel memory and yields local privilege escalation within the same security authority; no VM, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - This is a use-after-free of a `struct vm_area_struct` from the global `vm_area_cachep`, which an attacker reclaims trivially with a concurrent `mmap()`, gaining control of `vm_start/vm_end`, `vm_mm`, and `vm_page_prot`. `vm_insert_page()` then maps attacker-held binder pages into an unintended (potentially cross-process) mapping, enabling disclosure of memory beyond the attacker's own address space.\nI:H - The UAF is not read-only — `vm_insert_page()` performs `vm_flags_set(vma, VM_MIXEDMAP)`, writing into the freed/reclaimed slab object, and then installs page-table entries derived from its attacker-controllable fields. This yields a page-mapping and heap-corruption primitive of the same class as previously weaponized binder UAFs used for Android root escalation.\nA:H - The KASAN report in the fix commit shows a use-after-free read in `vm_insert_page()` reachable from a normal binder ioctl, and unsuccessful exploitation attempts corrupt page tables or the freed slab object, causing an oops or panic. The attacker can retrigger the race repeatedly."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/android/binder_alloc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "dd2283f2605e3b3e9c61bcae844b34f2afa4813f",
|
|
"lessThan": "1bb8a65190d45cd5c7dbc85e29b9102110cd6be6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "dd2283f2605e3b3e9c61bcae844b34f2afa4813f",
|
|
"lessThan": "931ea1ed31be939c1efdbc49bc66d2a45684f9b4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "dd2283f2605e3b3e9c61bcae844b34f2afa4813f",
|
|
"lessThan": "ca0cc0a9c6e56c699e2acbb93d8024523021f3c3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "dd2283f2605e3b3e9c61bcae844b34f2afa4813f",
|
|
"lessThan": "d1d8875c8c13517f6fd1ff8d4d3e1ac366a17e07",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/android/binder_alloc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.20",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.20",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.115",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.31",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.5",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.20",
|
|
"versionEndExcluding": "5.15.115"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.20",
|
|
"versionEndExcluding": "6.1.31"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.20",
|
|
"versionEndExcluding": "6.3.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.20",
|
|
"versionEndExcluding": "6.4"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1bb8a65190d45cd5c7dbc85e29b9102110cd6be6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/931ea1ed31be939c1efdbc49bc66d2a45684f9b4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ca0cc0a9c6e56c699e2acbb93d8024523021f3c3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d1d8875c8c13517f6fd1ff8d4d3e1ac366a17e07"
|
|
}
|
|
],
|
|
"title": "binder: fix UAF of alloc->vma in race with munmap()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |