Executive brief
The Linux kernel's binder subsystem (an inter-process communication mechanism used extensively on Android devices) contains a use-after-free vulnerability in its memory management code. An attacker could exploit this race condition between memory unmapping and page updates to cause a kernel crash or potentially execute code with kernel privileges.
Technical details
The vulnerability is a use-after-free (UAF) in the binder_update_page_range() function caused by a race condition with munmap(). The binder subsystem previously relied on the mmap read lock to protect alloc->vma, but a kernel change (commit dd2283f2605e) now downgrades the mmap_lock after detaching the VMA from the rbtree, allowing vm_area_free() to run concurrently with reads of alloc->vma. This causes binder code to access memory that has been freed. The fix reverts to using the mmap write lock within binder_update_page_range() to serialize access, mitigating the race. The vulnerability is reachable locally by any process with access to binder (typically unprivileged on Android), and the attack requires no special preconditions beyond triggering concurrent mmap/munmap operations alongside binder transactions.
Affected products
- Linux Linux kernel 5.10.0 through 5.10.150 and later mainline versions after revert of commit a43cfc87caaf
Timeline
- 2025-12-24: disclosed: CVE-2023-54157 published