CVE-2023-52438: binder: fix use-after-free in shinker's callback
In the Linux kernel, the following vulnerability has been resolved:
binder: fix use-after-free in shinker's callback
The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmapsem in munmap") the mmap lock is downgraded after the vma has been isolated.
I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF:
================================================================== BUG: KASAN: slab-use-after-free in zappagerangesingle+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478
CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zappagerangesingle+0x470/0x4b8 binderallocfreepage+0x608/0xadc listlruwalkone+0x130/0x3b0 listlruwalknode+0xc4/0x22c bindershrinkscan+0x108/0x1dc shrinkerdebugfsscanwrite+0x2b4/0x500 fullproxywrite+0xd4/0x140 vfswrite+0x1ac/0x758 ksyswrite+0xf0/0x1dc arm64syswrite+0x6c/0x9c
Allocated by task 492: kmemcachealloc+0x130/0x368 vmareaalloc+0x2c/0x190 mmapregion+0x258/0x18bc dommap+0x694/0xa60 vmmmappgoff+0x170/0x29c ksysmmappgoff+0x290/0x3a0 arm64sysmmap+0xcc/0x144
Freed by task 491: kmemcachefree+0x17c/0x3c8 vmareafreercucb+0x74/0x98 rcucore+0xa38/0x26d4 rcucoresi+0x10/0x1c dosoftirq+0x2fc/0xd24
Last potentially related work creation: callrcucommon.constprop.0+0x6c/0xba0 callrcu+0x10/0x1c vmareafree+0x18/0x24 removevma+0xe4/0x118 dovmialignmunmap.isra.0+0x718/0xb5c dovmimunmap+0xdc/0x1fc vmmunmap+0x10c/0x278 arm64sysmunmap+0x58/0x7c
Fix this issue by performing instead a vmalookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmapwritetrylock() has been recently removed anyway.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch binder: fix use-after-free in shinker's callback - Configuration
Apply the kernel change that avoids using alloc->vma during the shrinker callback when only the mmap read lock is held; instead perform a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade.
Linux kernel mmap locking mmap read lock usage during shrinker callback = use vma_lookup() failure path instead of alloc->vma pointer
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52438?
CVE-2023-52438 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2023-52438?
To fix CVE-2023-52438, update your Linux kernel to a patched version such as 5.10.223-1 or 6.1.123-1.
Which Linux kernel versions are affected by CVE-2023-52438?
CVE-2023-52438 affects Linux kernel versions from 4.20.0 up to 6.7.0, excluding newer versions.
What type of vulnerability is CVE-2023-52438?
CVE-2023-52438 is a use-after-free vulnerability in the binder subsystem of the Linux kernel.
Can CVE-2023-52438 lead to system crashes?
Yes, CVE-2023-52438 can potentially lead to system crashes or instability due to improper memory handling.