{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-03T13:21:23.431","vulnerabilities":[{"cve":{"id":"CVE-2023-52609","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2024-03-18T11:15:07.743","lastModified":"2025-03-10T15:28:37.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix race between mmput() and do_exit()\n\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\n\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\n\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it's dead).\n\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\n\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm->async_put_work WQ instead of Task A."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binder: corrige la ejecución entre mmput() y do_exit() La tarea A llama a binder_update_page_range() para asignar e insertar páginas en un espacio de direcciones remoto desde la tarea B. Para esto, la tarea A fija el mm remoto a través de mmget_not_zero() primero. Esto puede competir con la Tarea B do_exit() y la disminución final del recuento de mmput() provendrá de la Tarea A. Tarea A | Tarea B ------------------+------------------ mmget_not_zero() | | hacer_salir() | salida_mm() | mmput() mmput() | salida_mmap() | eliminar_vma() | salida() | En este caso, el trabajo de ____fput() de la Tarea B se pone en cola en la Tarea A como TWA_RESUME. Entonces, en teoría, la Tarea A regresa al espacio de usuario y se ejecuta el trabajo de limpieza. Sin embargo, la Tarea A duerme, esperando una respuesta de la Tarea B que nunca llega (está muerta). Esto significa que binder_deferred_release() está bloqueado hasta que un evento de carpeta no relacionado obligue a la Tarea A a regresar al espacio de usuario. Todas las notificaciones de defunción asociadas también se retrasarán hasta entonces. Para solucionar este problema, utilice mmput_async() que programará el trabajo en el mm->async_put_work WQ correspondiente en lugar de la Tarea A."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"4.19.306","matchCriteriaId":"D8EE6C94-F3E4-4963-8B5A-9BE8CD1565DF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.268","matchCriteriaId":"991BF737-6083-429B-ACD5-FB27D4143E2F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.209","matchCriteriaId":"74979A03-4B10-4815-AE3E-C8C0D2FDAA39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.148","matchCriteriaId":"2ED0CDB9-61B0-408E-B2A8-5199107F7868"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.75","matchCriteriaId":"070D0ED3-90D0-4F95-B1FF-57D7F46F332D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.14","matchCriteriaId":"5C6B50A6-3D8B-4CE2-BDCC-A098609CBA14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.2","matchCriteriaId":"7229C448-E0C9-488B-8939-36BA5254065E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/252a2a5569eb9f8d16428872cc24dea1ac0bb097","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/6696f76c32ff67fec26823fc2df46498e70d9bf3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/67f16bf2cc1698fd50e01ee8a2becc5a8e6d3a3e","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/77d210e8db4d61d43b2d16df66b1ec46fad2ee01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/7e7a0d86542b0ea903006d3f42f33c4f7ead6918","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/95b1d336b0642198b56836b89908d07b9a0c9608","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/98fee5bee97ad47b527a997d5786410430d1f0e9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://git.kernel.org/stable/c/9a9ab0d963621d9d12199df9817e66982582d5a5","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]}]}}]}