CVE-2024-56556: Android Linux Kernel - Use After Free Vulnerability in Binder
Summary
CVE-2024-56556: In binder_add_freeze_work of binder.c, there is a possible use after free due to a race condition. Affects :linux_kernel: versions >= :0, < :2025-04-05. Fixed in :2025-04-05. How to fix ↓
Also tracked for
- linux · Debian:13
The same CVE-2024-56556 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Linux Kernel is a core component of the Android operating system, responsible for managing hardware resources and providing essential services to applications. It facilitates communication between the hardware and software layers, ensuring efficient operation of the device. This vulnerability arises from a race condition in the binder subsystem, which can lead to security risks if not addressed promptly.
Vulnerability Detail
In the binder_add_freeze_work function of binder.c, a use after free vulnerability exists due to a race condition. This flaw allows an attacker to escalate privileges locally without requiring additional execution privileges. The vulnerability can be exploited without user interaction, making it particularly dangerous as it can be triggered by malicious applications running on the device.
How To Fix
Minimum fixed version
:2025-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability other than applying the patch as soon as it is available.
Conclusion
The CVE-2024-56556 vulnerability in the Android Linux Kernel poses a significant risk due to its potential for local privilege escalation without user interaction. It is crucial for users to update their systems to the patched version to mitigate this risk effectively.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2024-56556 is a vulnerability in the Android Linux Kernel that allows for local privilege escalation due to a use after free condition in the binder subsystem.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in your software.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
If your device is vulnerable, you should update to the patched version of the Android Linux Kernel as soon as it becomes available from your device manufacturer.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the gradle.lockfile, allowing for real-time vulnerability management without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
