CVE-2023-52609

2024-03-1800:00:00

ubuntu.com

linux kernel

vulnerability

binder

race

mmput

do_exit

cleanup

blocked binder_deferred_release

6.2 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%

JSON

In the Linux kernel, the following vulnerability has been resolved: binder:
fix race between mmput() and do_exit() Task A calls
binder_update_page_range() to allocate and insert pages on a remote address
space from Task B. For this, Task A pins the remote mm via mmget_not_zero()
first. This can race with Task B do_exit() and the final mmput() refcount
decrement will come from Task A. Task A | Task B
------------------±----------------- mmget_not_zero() | | do_exit() |
exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this
case, the work of ____fput() from Task B is queued up in Task A as
TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work
gets executed. However, Task A instead sleep, waiting for a reply from Task
B that never comes (it’s dead). This means the binder_deferred_release() is
blocked until an unrelated binder event forces Task A to go back to
userspace. All the associated death notifications will also be delayed
until then. In order to fix this use mmput_async() that will schedule the
work in the corresponding mm->async_put_work WQ instead of Task A.

Notes

Author	Note
rodrigo-zaiden	USN-6765-1 for linux-oem-6.5 wrongly stated that this CVE was fixed in version 6.5.0-1022.23. The mentioned notice was revoked and the state of the fix for linux-oem-6.5 was recovered to the previous state.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-176.196UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-102.112UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-41.41UNKNOWN
ubuntu24.04noarchlinux< 6.8.0-7.7UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1122.132UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1057.63UNKNOWN
ubuntu23.10noarchlinux-aws< 6.5.0-1021.21UNKNOWN
ubuntu24.04noarchlinux-aws< anyUNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1057.63~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1122.132~18.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-176.196	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-102.112	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-41.41	UNKNOWN
ubuntu	24.04	noarch	linux	< 6.8.0-7.7	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1122.132	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1057.63	UNKNOWN
ubuntu	23.10	noarch	linux-aws	< 6.5.0-1021.21	UNKNOWN
ubuntu	24.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1057.63~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1122.132~18.04.1	UNKNOWN