Bug 1935170 (CVE-2020-0423) - CVE-2020-0423 kernel: use-after-free in binder_release_work of binder.c due to improper locking may lead to local escalation of privilege
Summary: CVE-2020-0423 kernel: use-after-free in binder_release_work of binder.c due t...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-0423
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1935171
Blocks: 1935173
TreeView+ depends on / blocked
 
Reported: 2021-03-04 13:40 UTC by Marian Rehak
Modified: 2021-03-04 15:21 UTC (History)
42 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in the binder_release_work of binder.c due to improper locking. This flaw can lead to the local escalation of privileges in the kernel where no additional execution privileges are needed. User interaction is not needed for exploitation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-03-04 14:20:15 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2021-03-04 13:40:15 UTC 
In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

References:

https://source.android.com/security/bulletin/2020-10-01
Comment 1 Marian Rehak 2021-03-04 13:41:41 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1935171]
Comment 2 RaTasha Tillery-Smith 2021-03-04 14:04:11 UTC 
External References:

https://source.android.com/security/bulletin/2020-10-01
Comment 3 Justin M. Forbes 2021-03-04 15:21:34 UTC 
The android platform drivers are not enabled on Fedora.
Note You need to log in before you can comment on or make changes to this bug.