{"id":"ASB-A-380855429","details":"In binder_add_freeze_work of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-380855429","CVE-2024-56556"],"modified":"2026-04-21T15:25:42.831358Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/84ce22b0bcdb3c87ee36bc7213083aaf0de79e2e"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/a26cde405528cdf890f94956d4f61a19e3cc315d"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2025-04-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"types":["EoP"],"severity":"High","vanir_signatures":[{"id":"ASB-A-380855429-2394e407","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/84ce22b0bcdb3c87ee36bc7213083aaf0de79e2e","target":{"file":"drivers/android/binder.c"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["113519457968663428999208588565149208277","170010042509868609093064495653733499150","287081010186543995319927861005993002505","229127503102060396528631827471930645155","11689548084189178092449762277363402699","308705181095334396650545508353199661537","29260424378624128962858238439959502242","70896399710500306485788527988469956839","53363189695888639846966353040402251777","13493924392500315384052105706430377807","318166828823032113599958020370579404951","232576272002824891944472990703476826977","104828980373488623326297477565762392975","143616812705682324535196470326086591925","93895699590936234032737886626640673819","261512501167427232020980221916131799687","111401035767074571420544699882214607823"]},"deprecated":false},{"id":"ASB-A-380855429-939fd4c7","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a26cde405528cdf890f94956d4f61a19e3cc315d","target":{"file":"drivers/android/binder.c"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["113519457968663428999208588565149208277","170010042509868609093064495653733499150","287081010186543995319927861005993002505","229127503102060396528631827471930645155","11689548084189178092449762277363402699","308705181095334396650545508353199661537","29260424378624128962858238439959502242","70896399710500306485788527988469956839","53363189695888639846966353040402251777","13493924392500315384052105706430377807","318166828823032113599958020370579404951","232576272002824891944472990703476826977","104828980373488623326297477565762392975","143616812705682324535196470326086591925","93895699590936234032737886626640673819","261512501167427232020980221916131799687","111401035767074571420544699882214607823"]},"deprecated":false},{"id":"ASB-A-380855429-b8ceda2b","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/84ce22b0bcdb3c87ee36bc7213083aaf0de79e2e","target":{"function":"binder_add_freeze_work","file":"drivers/android/binder.c"},"signature_type":"Function","digest":{"length":906,"function_hash":"262406987265569266840292832199140035606"},"deprecated":false},{"id":"ASB-A-380855429-d68cc42c","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/a26cde405528cdf890f94956d4f61a19e3cc315d","target":{"function":"binder_add_freeze_work","file":"drivers/android/binder.c"},"signature_type":"Function","digest":{"length":906,"function_hash":"262406987265569266840292832199140035606"},"deprecated":false}],"spl":"2025-04-05","fixes":["https://android.googlesource.com/kernel/common/+/84ce22b0bcdb3c87ee36bc7213083aaf0de79e2e","https://android.googlesource.com/kernel/common/+/a26cde405528cdf890f94956d4f61a19e3cc315d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-380855429.json"}}],"schema_version":"1.7.5"}