CVE-2022-50240

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with. Instead, change the binder_alloc struct to record the start addres...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 27a594bc7a7c8238d239e3cdbcf2edfa3bbe9a1b, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 015ac18be7de25d17d6e5f1643cb3b60bfbe859e, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 622ef885a89ad04cfb76ee478fb44f051125d1f1, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 925e6b6f82c9c80ab3c17acbde8d16f349da7d26, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < 1ec3f76a436d750fd5023caec5da0494fc2870d2, >= dd2283f2605e3b3e9c61bcae844b34f2afa4813f < a43cfc87caaf46710c8027a8c23b8a55f1078f19, >= 4.20, >= 4.20 < 5.4.224, >= 5.5 < 5.10.154, >= 5.11 < 5.15.61, >= 5.16 < 5.18.18, >= 5.19 < 5.19.2

Fixed versions

5.4.224, 5.10.154, 5.15.61, 5.18.18, 5.19.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416