Use-after-free in Linux kernel binder

1) Use-after-free

EUVDB-ID: #VU87593

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52438

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the binder_alloc_free_page() function in drivers/android/binder_alloc.c. A local user can trigger a race condition and escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/a53e15e592b4dcc91c3a3b8514e484a0bdbc53a3
http://git.kernel.org/stable/c/c8c1158ffb007197f31f9d9170cf13e4f34cbb5c
http://git.kernel.org/stable/c/8ad4d580e8aff8de2a4d57c5930fcc29f1ffd4a6
http://git.kernel.org/stable/c/9fa04c93f24138747807fe75b5591bb680098f56
http://git.kernel.org/stable/c/a49087ab93508b60d9b8add91707a22dda832869
http://git.kernel.org/stable/c/e074686e993ff1be5f21b085a3b1b4275ccd5727
http://git.kernel.org/stable/c/3f489c2067c5824528212b0fc18b28d51332d906

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.