{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49939", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-05-01T14:05:17.255Z", "datePublished": "2025-06-18T10:54:40.100Z", "dateUpdated": "2026-08-05T08:56:48.206Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:48.206Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF of ref->proc caused by race condition\n\nA transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the\nreference for a node. In this case, the target proc normally releases\nthe failed reference upon close as expected. However, if the target is\ndying in parallel the call will race with binder_deferred_release(), so\nthe target could have released all of its references by now leaving the\ncleanup of the new failed reference unhandled.\n\nThe transaction then ends and the target proc gets released making the\nref->proc now a dangling pointer. Later on, ref->node is closed and we\nattempt to take spin_lock(&ref->proc->inner_lock), which leads to the\nuse-after-free bug reported below. Let's fix this by cleaning up the\nfailed reference on the spot instead of relying on the target to do so.\n\n ==================================================================\n BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150\n Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590\n\n CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10\n Hardware name: linux,dummy-virt (DT)\n Workqueue: events binder_deferred_func\n Call trace:\n dump_backtrace.part.0+0x1d0/0x1e0\n show_stack+0x18/0x70\n dump_stack_lvl+0x68/0x84\n print_report+0x2e4/0x61c\n kasan_report+0xa4/0x110\n kasan_check_range+0xfc/0x1a4\n __kasan_check_write+0x3c/0x50\n _raw_spin_lock+0xa8/0x150\n binder_deferred_func+0x5e0/0x9b0\n process_one_work+0x38c/0x5f0\n worker_thread+0x9c/0x694\n kthread+0x188/0x190\n ret_from_fork+0x10/0x20" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Reachable only via local ioctl on /dev/binder (or binderfs); requires opening the binder device and issuing BC_TRANSACTION commands, not network or adjacent protocols.\nAC:L - The attacker controls both sides of the race (sender transaction and target proc exit/close), and public exploitation of CVE-2022-20421 shows the race can be won reliably (reported 100% with a widened window).\nPR:L - binder_open has no capability check; on Android phones (the primary binder deployment) an unprivileged untrusted_app can open /dev/binder and trigger the path.\nUI:N - Exploitation needs no victim action; the attacker’s own processes open binder, exchange the crafted weak-handle transaction, and close the target fd.\nS:U - Impact is privilege escalation within the same OS kernel authority (local LPE), not a VM/IOMMU/sandbox boundary escape.\nC:H - Use-after-free of binder_proc enables heap reuse and, as demonstrated publicly, arbitrary kernel read primitives for full confidentiality compromise.\nI:H - The same UAF has been developed into type confusion and arbitrary kernel write / LPE, so integrity impact is High per UAF guidance and proven exploits.\nA:H - The UAF manifests as a kernel oops/KASAN use-after-free on spin_lock of freed ref->proc and can crash or hang the system even without full exploitation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/android/binder.c" ], "versions": [ { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "229f47603dd306bc0eb1a831439adb8e48bb0eae", "status": "affected", "versionType": "git" }, { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "06e5b43ca4dab06a92bf4c2f33766e6fb11b880a", "status": "affected", "versionType": "git" }, { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "30d0901b307f27d36b2655fb3048cf31ee0e89c0", "status": "affected", "versionType": "git" }, { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "9629f2dfdb1dad294b468038ff8e161e94d0b609", "status": "affected", "versionType": "git" }, { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "c2a4b5dc8fa71af73bab704d0cac42ac39767ed6", "status": "affected", "versionType": "git" }, { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "603a47f2ae56bf68288784d3c0a8c5b8e0a827ed", "status": "affected", "versionType": "git" }, { "version": "372e3147df7016ebeaa372939e8774a1292db558", "lessThan": "a0e44c64b6061dda7e00b7c458e4523e2331b739", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/android/binder.c" ], "versions": [ { "version": "4.14", "status": "affected" }, { "version": "0", "lessThan": "4.14", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.293", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.258", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.213", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.142", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.66", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.8", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "4.14.293" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "4.19.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.4.213" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.10.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.15.66" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.19.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/229f47603dd306bc0eb1a831439adb8e48bb0eae" }, { "url": "https://git.kernel.org/stable/c/06e5b43ca4dab06a92bf4c2f33766e6fb11b880a" }, { "url": "https://git.kernel.org/stable/c/30d0901b307f27d36b2655fb3048cf31ee0e89c0" }, { "url": "https://git.kernel.org/stable/c/9629f2dfdb1dad294b468038ff8e161e94d0b609" }, { "url": "https://git.kernel.org/stable/c/c2a4b5dc8fa71af73bab704d0cac42ac39767ed6" }, { "url": "https://git.kernel.org/stable/c/603a47f2ae56bf68288784d3c0a8c5b8e0a827ed" }, { "url": "https://git.kernel.org/stable/c/a0e44c64b6061dda7e00b7c458e4523e2331b739" } ], "title": "binder: fix UAF of ref->proc caused by race condition", "x_generator": { "engine": "bippy-1.2.0" } } } }