CVE-2024-46740 (GCVE-0-2024-46740)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-08-05 11:38
VLAI
Title
binder: fix UAF caused by offsets overwrite
Summary
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c056a6ba35e00ae943e377eb09abd77a6915b31a , < 5a32bfd23022ffa7e152f273fa3fa29befb7d929 (git)
Affected: 23e9d815fad84c1bee3742a8de4bd39510435362 , < 3a8154bb4ab4a01390a3abf1e6afac296e037da4 (git)
Affected: 7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde , < eef79854a04feac5b861f94d7b19cbbe79874117 (git)
Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < 4f79e0b80dc69bd5eaaed70f0df1b558728b4e59 (git)
Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < 1f33d9f1d9ac3f0129f8508925000900c2fe5bb0 (git)
Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < 109e845c1184c9f786d41516348ba3efd9112792 (git)
Affected: 6d98eb95b450a75adb4516a1d33652dc78d2b20c , < 4df153652cc46545722879415937582028c18af5 (git)
Affected: 66e12f5b3a9733f941893a00753b10498724607d (git)
Affected: 5.4.226 , < 5.4.284 (semver)
Affected: 5.10.157 , < 5.10.226 (semver)
Affected: 5.15.17 , < 5.15.167 (semver)
Affected: 5.16.3 , < 5.17 (semver)
Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 5.4.284 , ≤ 5.4.* (semver)
Unaffected: 5.10.226 , ≤ 5.10.* (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.110 , ≤ 6.1.* (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T15:46:39.032275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T15:56:06.412Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:17:29.741Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a32bfd23022ffa7e152f273fa3fa29befb7d929",
              "status": "affected",
              "version": "c056a6ba35e00ae943e377eb09abd77a6915b31a",
              "versionType": "git"
            },
            {
              "lessThan": "3a8154bb4ab4a01390a3abf1e6afac296e037da4",
              "status": "affected",
              "version": "23e9d815fad84c1bee3742a8de4bd39510435362",
              "versionType": "git"
            },
            {
              "lessThan": "eef79854a04feac5b861f94d7b19cbbe79874117",
              "status": "affected",
              "version": "7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde",
              "versionType": "git"
            },
            {
              "lessThan": "4f79e0b80dc69bd5eaaed70f0df1b558728b4e59",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "1f33d9f1d9ac3f0129f8508925000900c2fe5bb0",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "109e845c1184c9f786d41516348ba3efd9112792",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "lessThan": "4df153652cc46545722879415937582028c18af5",
              "status": "affected",
              "version": "6d98eb95b450a75adb4516a1d33652dc78d2b20c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "66e12f5b3a9733f941893a00753b10498724607d",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.284",
              "status": "affected",
              "version": "5.4.226",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.226",
              "status": "affected",
              "version": "5.10.157",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.167",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.284",
                  "versionStartIncluding": "5.4.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "5.10.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF caused by offsets overwrite\n\nBinder objects are processed and copied individually into the target\nbuffer during transactions. Any raw data in-between these objects is\ncopied as well. However, this raw data copy lacks an out-of-bounds\ncheck. If the raw data exceeds the data section size then the copy\noverwrites the offsets section. This eventually triggers an error that\nattempts to unwind the processed objects. However, at this point the\noffsets used to index these objects are now corrupted.\n\nUnwinding with corrupted offsets can result in decrements of arbitrary\nnodes and lead to their premature release. Other users of such nodes are\nleft with a dangling pointer triggering a use-after-free. This issue is\nmade evident by the following KASAN report (trimmed):\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\n  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743\n\n  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   _raw_spin_lock+0xe4/0x19c\n   binder_free_buf+0x128/0x434\n   binder_thread_write+0x8a4/0x3260\n   binder_ioctl+0x18f0/0x258c\n  [...]\n\n  Allocated by task 743:\n   __kmalloc_cache_noprof+0x110/0x270\n   binder_new_node+0x50/0x700\n   binder_transaction+0x413c/0x6da8\n   binder_thread_write+0x978/0x3260\n   binder_ioctl+0x18f0/0x258c\n  [...]\n\n  Freed by task 745:\n   kfree+0xbc/0x208\n   binder_thread_read+0x1c5c/0x37d4\n   binder_ioctl+0x16d8/0x258c\n  [...]\n  ==================================================================\n\nTo avoid this issue, let\u0027s check that the raw data copy is within the\nboundaries of the data section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached via ioctl(BINDER_WRITE_READ) with BC_TRANSACTION/BC_REPLY on a local binder device file (/dev/binder or a binderfs device); it requires local system access, not network.\nAC:L - The attacker fully controls the transaction\u0027s data_size, offsets array, and raw payload, so overwriting the offsets section and corrupting node references is deterministic and reproducible in a single process, with no race to win.\nPR:L - An unprivileged local user needs only access to a binder device; binderfs is FS_USERNS_MOUNT, so a user can mount an instance in a user namespace and drive transactions without real root.\nUI:N - The bug is triggered entirely by the attacker\u0027s own ioctl calls; no action by any other user is required.\nS:U - The corruption and its impact remain within the kernel\u0027s own memory/security authority, i.e. standard local kernel compromise with no boundary crossing.\nC:H - The premature free of a binder_node yields a use-after-free where the attacker can control freed-object contents, enabling arbitrary kernel memory disclosure.\nI:H - The UAF plus arbitrary node-refcount decrements provide a write primitive over freed/adjacent kernel objects, exploitable for heap spraying and control-flow hijacking.\nA:H - The use-after-free reliably corrupts kernel memory and causes an oops/panic, as shown by the KASAN slab-use-after-free write report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:15.991Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a32bfd23022ffa7e152f273fa3fa29befb7d929"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a8154bb4ab4a01390a3abf1e6afac296e037da4"
        },
        {
          "url": "https://git.kernel.org/stable/c/eef79854a04feac5b861f94d7b19cbbe79874117"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f79e0b80dc69bd5eaaed70f0df1b558728b4e59"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f33d9f1d9ac3f0129f8508925000900c2fe5bb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792"
        },
        {
          "url": "https://git.kernel.org/stable/c/4df153652cc46545722879415937582028c18af5"
        }
      ],
      "title": "binder: fix UAF caused by offsets overwrite",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46740",
    "datePublished": "2024-09-18T07:12:01.653Z",
    "dateReserved": "2024-09-11T15:12:18.263Z",
    "dateUpdated": "2026-08-05T11:38:15.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46740",
      "date": "2026-08-04",
      "epss": "0.00289",
      "percentile": "0.21164"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4.226\", \"versionEndExcluding\": \"5.4.284\", \"matchCriteriaId\": \"F0B6E199-279F-4F92-B463-C5F87E230BCE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.157\", \"versionEndExcluding\": \"5.10.226\", \"matchCriteriaId\": \"D93C7D07-3360-4012-AFCB-4F16A83F0753\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.17\", \"versionEndExcluding\": \"5.15.167\", \"matchCriteriaId\": \"DC1E2D56-0897-4435-BC25-739B04462E13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.17\", \"versionEndExcluding\": \"6.1.110\", \"matchCriteriaId\": \"BBF34251-254C-4A5B-A072-3C3A93781706\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"E4529134-BAC4-4776-840B-304009E181A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: fix UAF caused by offsets overwrite\\n\\nBinder objects are processed and copied individually into the target\\nbuffer during transactions. Any raw data in-between these objects is\\ncopied as well. However, this raw data copy lacks an out-of-bounds\\ncheck. If the raw data exceeds the data section size then the copy\\noverwrites the offsets section. This eventually triggers an error that\\nattempts to unwind the processed objects. However, at this point the\\noffsets used to index these objects are now corrupted.\\n\\nUnwinding with corrupted offsets can result in decrements of arbitrary\\nnodes and lead to their premature release. Other users of such nodes are\\nleft with a dangling pointer triggering a use-after-free. This issue is\\nmade evident by the following KASAN report (trimmed):\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\\n  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743\\n\\n  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1\\n  Hardware name: linux,dummy-virt (DT)\\n  Call trace:\\n   _raw_spin_lock+0xe4/0x19c\\n   binder_free_buf+0x128/0x434\\n   binder_thread_write+0x8a4/0x3260\\n   binder_ioctl+0x18f0/0x258c\\n  [...]\\n\\n  Allocated by task 743:\\n   __kmalloc_cache_noprof+0x110/0x270\\n   binder_new_node+0x50/0x700\\n   binder_transaction+0x413c/0x6da8\\n   binder_thread_write+0x978/0x3260\\n   binder_ioctl+0x18f0/0x258c\\n  [...]\\n\\n  Freed by task 745:\\n   kfree+0xbc/0x208\\n   binder_thread_read+0x1c5c/0x37d4\\n   binder_ioctl+0x16d8/0x258c\\n  [...]\\n  ==================================================================\\n\\nTo avoid this issue, let\u0027s check that the raw data copy is within the\\nboundaries of the data section.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binder: fix UAF caused by offsets overwrite Los objetos Binder se procesan y copian individualmente en el b\\u00fafer de destino durante las transacciones. Tambi\\u00e9n se copian todos los datos sin procesar entre estos objetos. Sin embargo, esta copia de datos sin procesar carece de una comprobaci\\u00f3n de fuera de los l\\u00edmites. Si los datos sin procesar superan el tama\\u00f1o de la secci\\u00f3n de datos, la copia sobrescribe la secci\\u00f3n de compensaciones. Esto finalmente desencadena un error que intenta desenrollar los objetos procesados. Sin embargo, en este punto, las compensaciones utilizadas para indexar estos objetos ahora est\\u00e1n da\\u00f1adas. El desenrollado con compensaciones da\\u00f1adas puede resultar en disminuciones de nodos arbitrarios y conducir a su liberaci\\u00f3n prematura. Otros usuarios de dichos nodos se quedan con un puntero colgante que activa un use after free. Este problema se hace evidente en el siguiente informe de KASAN (recortado): ===================================================================== ERROR: KASAN: slab-use-after-free en _raw_spin_lock+0xe4/0x19c Escritura de tama\\u00f1o 4 en la direcci\\u00f3n ffff47fc91598f04 por la tarea binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util No contaminado 6.11.0-rc4 #1 Nombre del hardware: linux,dummy-virt (DT) Rastreo de llamadas: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Asignado por la tarea 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Liberado por la tarea 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ======================================================================= Para evitar este problema, verifiquemos que la copia de datos sin procesar est\\u00e9 dentro de los l\\u00edmites de la secci\\u00f3n de datos.\"}]",
      "id": "CVE-2024-46740",
      "lastModified": "2024-09-20T18:34:08.163",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-09-18T08:15:03.377",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1f33d9f1d9ac3f0129f8508925000900c2fe5bb0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a8154bb4ab4a01390a3abf1e6afac296e037da4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4df153652cc46545722879415937582028c18af5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4f79e0b80dc69bd5eaaed70f0df1b558728b4e59\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a32bfd23022ffa7e152f273fa3fa29befb7d929\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/eef79854a04feac5b861f94d7b19cbbe79874117\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:03:03.000Z",
      "cve": "CVE-2024-46740",
      "id": "msrc_CVE-2024-46740",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "binder: fix UAF caused by offsets overwrite",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46740.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46740\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:03.377\",\"lastModified\":\"2026-06-17T07:55:50.097\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: fix UAF caused by offsets overwrite\\n\\nBinder objects are processed and copied individually into the target\\nbuffer during transactions. Any raw data in-between these objects is\\ncopied as well. However, this raw data copy lacks an out-of-bounds\\ncheck. If the raw data exceeds the data section size then the copy\\noverwrites the offsets section. This eventually triggers an error that\\nattempts to unwind the processed objects. However, at this point the\\noffsets used to index these objects are now corrupted.\\n\\nUnwinding with corrupted offsets can result in decrements of arbitrary\\nnodes and lead to their premature release. Other users of such nodes are\\nleft with a dangling pointer triggering a use-after-free. This issue is\\nmade evident by the following KASAN report (trimmed):\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\\n  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743\\n\\n  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1\\n  Hardware name: linux,dummy-virt (DT)\\n  Call trace:\\n   _raw_spin_lock+0xe4/0x19c\\n   binder_free_buf+0x128/0x434\\n   binder_thread_write+0x8a4/0x3260\\n   binder_ioctl+0x18f0/0x258c\\n  [...]\\n\\n  Allocated by task 743:\\n   __kmalloc_cache_noprof+0x110/0x270\\n   binder_new_node+0x50/0x700\\n   binder_transaction+0x413c/0x6da8\\n   binder_thread_write+0x978/0x3260\\n   binder_ioctl+0x18f0/0x258c\\n  [...]\\n\\n  Freed by task 745:\\n   kfree+0xbc/0x208\\n   binder_thread_read+0x1c5c/0x37d4\\n   binder_ioctl+0x16d8/0x258c\\n  [...]\\n  ==================================================================\\n\\nTo avoid this issue, let\u0027s check that the raw data copy is within the\\nboundaries of the data section.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binder: fix UAF caused by offsets overwrite Los objetos Binder se procesan y copian individualmente en el b\u00fafer de destino durante las transacciones. Tambi\u00e9n se copian todos los datos sin procesar entre estos objetos. Sin embargo, esta copia de datos sin procesar carece de una comprobaci\u00f3n de fuera de los l\u00edmites. Si los datos sin procesar superan el tama\u00f1o de la secci\u00f3n de datos, la copia sobrescribe la secci\u00f3n de compensaciones. Esto finalmente desencadena un error que intenta desenrollar los objetos procesados. Sin embargo, en este punto, las compensaciones utilizadas para indexar estos objetos ahora est\u00e1n da\u00f1adas. El desenrollado con compensaciones da\u00f1adas puede resultar en disminuciones de nodos arbitrarios y conducir a su liberaci\u00f3n prematura. Otros usuarios de dichos nodos se quedan con un puntero colgante que activa un use after free. Este problema se hace evidente en el siguiente informe de KASAN (recortado): ===================================================================== ERROR: KASAN: slab-use-after-free en _raw_spin_lock+0xe4/0x19c Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff47fc91598f04 por la tarea binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util No contaminado 6.11.0-rc4 #1 Nombre del hardware: linux,dummy-virt (DT) Rastreo de llamadas: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Asignado por la tarea 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Liberado por la tarea 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ======================================================================= Para evitar este problema, verifiquemos que la copia de datos sin procesar est\u00e9 dentro de los l\u00edmites de la secci\u00f3n de datos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/android/binder.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c056a6ba35e00ae943e377eb09abd77a6915b31a\",\"lessThan\":\"5a32bfd23022ffa7e152f273fa3fa29befb7d929\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23e9d815fad84c1bee3742a8de4bd39510435362\",\"lessThan\":\"3a8154bb4ab4a01390a3abf1e6afac296e037da4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde\",\"lessThan\":\"eef79854a04feac5b861f94d7b19cbbe79874117\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"4f79e0b80dc69bd5eaaed70f0df1b558728b4e59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"1f33d9f1d9ac3f0129f8508925000900c2fe5bb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"109e845c1184c9f786d41516348ba3efd9112792\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d98eb95b450a75adb4516a1d33652dc78d2b20c\",\"lessThan\":\"4df153652cc46545722879415937582028c18af5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66e12f5b3a9733f941893a00753b10498724607d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.226\",\"lessThan\":\"5.4.284\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.157\",\"lessThan\":\"5.10.226\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.17\",\"lessThan\":\"5.15.167\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.3\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/android/binder.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.284\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.226\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.167\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.110\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-18T15:46:39.032275Z\",\"id\":\"CVE-2024-46740\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.226\",\"versionEndExcluding\":\"5.4.284\",\"matchCriteriaId\":\"F0B6E199-279F-4F92-B463-C5F87E230BCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.157\",\"versionEndExcluding\":\"5.10.226\",\"matchCriteriaId\":\"D93C7D07-3360-4012-AFCB-4F16A83F0753\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.17\",\"versionEndExcluding\":\"5.15.167\",\"matchCriteriaId\":\"DC1E2D56-0897-4435-BC25-739B04462E13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.1.110\",\"matchCriteriaId\":\"BBF34251-254C-4A5B-A072-3C3A93781706\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f33d9f1d9ac3f0129f8508925000900c2fe5bb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a8154bb4ab4a01390a3abf1e6afac296e037da4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4df153652cc46545722879415937582028c18af5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f79e0b80dc69bd5eaaed70f0df1b558728b4e59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a32bfd23022ffa7e152f273fa3fa29befb7d929\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eef79854a04feac5b861f94d7b19cbbe79874117\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:22:32+00:00",
      "cve": "CVE-2024-46740",
      "id": "CVE-2024-46740",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: binder: fix UAF caused by offsets overwrite",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46740.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T01:59:50Z",
      "cve": "CVE-2024-46740",
      "id": "CVE-2024-46740",
      "initial_release_date": "2024-09-19T03:10:47Z",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46740",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46740.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:17:29.741Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-18T15:46:39.032275Z\"}}}, {\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:50:37.415Z\"}}], \"cna\": {\"title\": \"binder: fix UAF caused by offsets overwrite\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c056a6ba35e00ae943e377eb09abd77a6915b31a\", \"lessThan\": \"5a32bfd23022ffa7e152f273fa3fa29befb7d929\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"23e9d815fad84c1bee3742a8de4bd39510435362\", \"lessThan\": \"3a8154bb4ab4a01390a3abf1e6afac296e037da4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a9ad4aceb0226b391c9d3b8e4ac2e7d438b6bde\", \"lessThan\": \"eef79854a04feac5b861f94d7b19cbbe79874117\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"4f79e0b80dc69bd5eaaed70f0df1b558728b4e59\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"1f33d9f1d9ac3f0129f8508925000900c2fe5bb0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"109e845c1184c9f786d41516348ba3efd9112792\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6d98eb95b450a75adb4516a1d33652dc78d2b20c\", \"lessThan\": \"4df153652cc46545722879415937582028c18af5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66e12f5b3a9733f941893a00753b10498724607d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.226\", \"lessThan\": \"5.4.284\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.157\", \"lessThan\": \"5.10.226\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.17\", \"lessThan\": \"5.15.167\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.3\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/android/binder.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.284\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.226\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/android/binder.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5a32bfd23022ffa7e152f273fa3fa29befb7d929\"}, {\"url\": \"https://git.kernel.org/stable/c/3a8154bb4ab4a01390a3abf1e6afac296e037da4\"}, {\"url\": \"https://git.kernel.org/stable/c/eef79854a04feac5b861f94d7b19cbbe79874117\"}, {\"url\": \"https://git.kernel.org/stable/c/4f79e0b80dc69bd5eaaed70f0df1b558728b4e59\"}, {\"url\": \"https://git.kernel.org/stable/c/1f33d9f1d9ac3f0129f8508925000900c2fe5bb0\"}, {\"url\": \"https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792\"}, {\"url\": \"https://git.kernel.org/stable/c/4df153652cc46545722879415937582028c18af5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: fix UAF caused by offsets overwrite\\n\\nBinder objects are processed and copied individually into the target\\nbuffer during transactions. Any raw data in-between these objects is\\ncopied as well. However, this raw data copy lacks an out-of-bounds\\ncheck. If the raw data exceeds the data section size then the copy\\noverwrites the offsets section. This eventually triggers an error that\\nattempts to unwind the processed objects. However, at this point the\\noffsets used to index these objects are now corrupted.\\n\\nUnwinding with corrupted offsets can result in decrements of arbitrary\\nnodes and lead to their premature release. Other users of such nodes are\\nleft with a dangling pointer triggering a use-after-free. This issue is\\nmade evident by the following KASAN report (trimmed):\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\\n  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743\\n\\n  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1\\n  Hardware name: linux,dummy-virt (DT)\\n  Call trace:\\n   _raw_spin_lock+0xe4/0x19c\\n   binder_free_buf+0x128/0x434\\n   binder_thread_write+0x8a4/0x3260\\n   binder_ioctl+0x18f0/0x258c\\n  [...]\\n\\n  Allocated by task 743:\\n   __kmalloc_cache_noprof+0x110/0x270\\n   binder_new_node+0x50/0x700\\n   binder_transaction+0x413c/0x6da8\\n   binder_thread_write+0x978/0x3260\\n   binder_ioctl+0x18f0/0x258c\\n  [...]\\n\\n  Freed by task 745:\\n   kfree+0xbc/0x208\\n   binder_thread_read+0x1c5c/0x37d4\\n   binder_ioctl+0x16d8/0x258c\\n  [...]\\n  ==================================================================\\n\\nTo avoid this issue, let\u0027s check that the raw data copy is within the\\nboundaries of the data section.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.284\", \"versionStartIncluding\": \"5.4.226\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.226\", \"versionStartIncluding\": \"5.10.157\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.167\", \"versionStartIncluding\": \"5.15.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.110\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.51\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.16.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:30.131Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:30.131Z\", \"dateReserved\": \"2024-09-11T15:12:18.263Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:01.653Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.