linux-cve-announce - CVE-2022-49939: binder: fix UAF of ref->proc caused by race condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061848-CVE-2022-49939-f8be@gregkh>
Date: Wed, 18 Jun 2025 12:54:50 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49939: binder: fix UAF of ref->proc caused by race condition

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF of ref->proc caused by race condition

A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the
reference for a node. In this case, the target proc normally releases
the failed reference upon close as expected. However, if the target is
dying in parallel the call will race with binder_deferred_release(), so
the target could have released all of its references by now leaving the
cleanup of the new failed reference unhandled.

The transaction then ends and the target proc gets released making the
ref->proc now a dangling pointer. Later on, ref->node is closed and we
attempt to take spin_lock(&ref->proc->inner_lock), which leads to the
use-after-free bug reported below. Let's fix this by cleaning up the
failed reference on the spot instead of relying on the target to do so.

  ==================================================================
  BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150
  Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590

  CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10
  Hardware name: linux,dummy-virt (DT)
  Workqueue: events binder_deferred_func
  Call trace:
   dump_backtrace.part.0+0x1d0/0x1e0
   show_stack+0x18/0x70
   dump_stack_lvl+0x68/0x84
   print_report+0x2e4/0x61c
   kasan_report+0xa4/0x110
   kasan_check_range+0xfc/0x1a4
   __kasan_check_write+0x3c/0x50
   _raw_spin_lock+0xa8/0x150
   binder_deferred_func+0x5e0/0x9b0
   process_one_work+0x38c/0x5f0
   worker_thread+0x9c/0x694
   kthread+0x188/0x190
   ret_from_fork+0x10/0x20

The Linux kernel CVE team has assigned CVE-2022-49939 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.293 with commit 229f47603dd306bc0eb1a831439adb8e48bb0eae
	Fixed in 4.19.258 with commit 06e5b43ca4dab06a92bf4c2f33766e6fb11b880a
	Fixed in 5.4.213 with commit 30d0901b307f27d36b2655fb3048cf31ee0e89c0
	Fixed in 5.10.142 with commit 9629f2dfdb1dad294b468038ff8e161e94d0b609
	Fixed in 5.15.66 with commit c2a4b5dc8fa71af73bab704d0cac42ac39767ed6
	Fixed in 5.19.8 with commit 603a47f2ae56bf68288784d3c0a8c5b8e0a827ed
	Fixed in 6.0 with commit a0e44c64b6061dda7e00b7c458e4523e2331b739

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49939
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/android/binder.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/229f47603dd306bc0eb1a831439adb8e48bb0eae
	https://git.kernel.org/stable/c/06e5b43ca4dab06a92bf4c2f33766e6fb11b880a
	https://git.kernel.org/stable/c/30d0901b307f27d36b2655fb3048cf31ee0e89c0
	https://git.kernel.org/stable/c/9629f2dfdb1dad294b468038ff8e161e94d0b609
	https://git.kernel.org/stable/c/c2a4b5dc8fa71af73bab704d0cac42ac39767ed6
	https://git.kernel.org/stable/c/603a47f2ae56bf68288784d3c0a8c5b8e0a827ed
	https://git.kernel.org/stable/c/a0e44c64b6061dda7e00b7c458e4523e2331b739