binder: fix is_failure flag for superseded transaction cleanup
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for superseded transaction cleanup When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, binder_apply_fd_fixups() was never called and no fds were installed in the target process. With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors. Pass is_failure=true since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 9864bb4801331daa48514face9d0f4861e4d485b · fixed in e9b364e46d594c2ec663c9c49f10c1ca541ecc0f; From 9864bb4801331daa48514face9d0f4861e4d485b · fixed in 60a9f7323ae7318a7cce0d387c318da24f1e8726; From 9864bb4801331daa48514face9d0f4861e4d485b · fixed in 86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff; From 9864bb4801331daa48514face9d0f4861e4d485b · fixed in 1ab671b50714ad8e359cf37eb041d8044319ccdc; From 9864bb4801331daa48514face9d0f4861e4d485b · fixed in 22c135635fdd9816c0ef140d6de7b2e4fdf73e89
- Linux Linux
6.0
- KernelLinux
From 6.0.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10