CVE-2024-56553

Summary

CVE-2024-56553 is a vulnerability affecting the Linux kernel where a memory leak occurs in the binder component. Specifically, if a freeze notification is cleared before calling binder_freeze_notification_done(), the corresponding entry in proc->delivered_freeze remains queued but is not freed when the process exits, resulting in an unreferenced object in memory. This issue can be exploited to cause a denial of service or potentially gain unauthorized access to system resources. The patch resolves this vulnerability by ensuring that any pending entries in proc->delivered_freeze are properly freed during binder_deferred_release().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.