{"id":"DEBIAN-CVE-2024-56555","details":"In the Linux kernel, the following vulnerability has been resolved:  binder: fix OOB in binder_add_freeze_work()  In binder_add_freeze_work() we iterate over the proc-\u003enodes with the proc-\u003einner_lock held. However, this lock is temporarily dropped to acquire the node-\u003elock first (lock nesting order). This can race with binder_deferred_release() which removes the nodes from the proc-\u003enodes rbtree and adds them into binder_dead_nodes list. This leads to a broken iteration in binder_add_freeze_work() as rb_next() will use data from binder_dead_nodes, triggering an out-of-bounds access:    ==================================================================   BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124   Read of size 8 at addr ffffcb84285f7170 by task freeze/660    CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18   Hardware name: linux,dummy-virt (DT)   Call trace:    rb_next+0xfc/0x124    binder_add_freeze_work+0x344/0x534    binder_ioctl+0x1e70/0x25ac    __arm64_sys_ioctl+0x124/0x190    The buggy address belongs to the variable:    binder_dead_nodes+0x10/0x40   [...]   ==================================================================  This is possible because proc-\u003enodes (rbtree) and binder_dead_nodes (list) share entries in binder_node through a union:  \tstruct binder_node { \t[...] \t\tunion { \t\t\tstruct rb_node rb_node; \t\t\tstruct hlist_node dead_node; \t\t};  Fix the race by checking that the proc is still alive. If not, simply break out of the iteration.","modified":"2026-09-15T09:02:37.710139329Z","published":"2024-12-27T15:15:14.297Z","upstream":["CVE-2024-56555"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-56555"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-56555.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-56555.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}