CVE-2024-26926: binder: check offset alignment in binder_get_object()
In binderalloccopytobuffer of binder.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
binder: check offset alignment in bindergetobject()
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binderalloccopyfrombuffer() -> checkbuffer().
These calls were replaced in bindergetobject() with copyfromuser(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.90-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2024-06-05
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26926?
CVE-2024-26926 has a moderate severity rating due to the potential for data leakage in the Linux kernel's binder system.
How do I fix CVE-2024-26926?
To fix CVE-2024-26926, update to the patched versions of the Linux kernel or upgrade to the specified newer versions in the Debian package list.
Which Linux versions are affected by CVE-2024-26926?
CVE-2024-26926 affects specific versions of the Linux kernel, including 5.10.223-1, 5.10.226-1, 6.1.119-1, and 6.12.10-1.
Is CVE-2024-26926 relevant to Android users?
Yes, CVE-2024-26926 is relevant to Android users as it impacts the Linux kernel components used in the Android operating system.
What functions are impacted by CVE-2024-26926?
CVE-2024-26926 specifically impacts the binder_get_object() function in the Linux kernel, leading to potential data leakage.