In the Linux kernel, the following vulnerability has been resolved:
binder: signal epoll threads of self-work
In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDERWRITEREAD without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards.
It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work.
[
{
"id": "CVE-2024-26606-1abf26e3",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b372c39c40cbf179e56621e6bc48240943af69",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-30c5d154",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97830f3c3088638ff90b20dfba2eb4d487bf14d7",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-334097b4",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82722b453dc2f967b172603e389ee7dc1b3137cc",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-4b6c2741",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd64bb8329ce0ea27bc557e4160c2688835402ac",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-60d4b512",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a423042052ec2bdbf1e552e621e6a768922363cc",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-61390bc2",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97830f3c3088638ff90b20dfba2eb4d487bf14d7",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-66ca56ba",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd64bb8329ce0ea27bc557e4160c2688835402ac",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-7abe2297",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ae586f6f6024f490b8546c8c84670f96bb9b68",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-7dafba93",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e09c016d72b91e76de25f71c7b93d94cc3c769",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-893ac51c",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42beab162dcee1e691ee4934292d51581c29df61",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-8b287c95",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e09c016d72b91e76de25f71c7b93d94cc3c769",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-98c4bf25",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b372c39c40cbf179e56621e6bc48240943af69",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-b481ed5c",
"deprecated": false,
"digest": {
"length": 190.0,
"function_hash": "116350721133535895225407234038268298661"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a423042052ec2bdbf1e552e621e6a768922363cc",
"target": {
"function": "binder_enqueue_thread_work_ilocked",
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2024-26606-ca33d9c7",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ae586f6f6024f490b8546c8c84670f96bb9b68",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-cdb4bd4b",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42beab162dcee1e691ee4934292d51581c29df61",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2024-26606-eea2bb97",
"deprecated": false,
"digest": {
"line_hashes": [
"41504420359155318588145586819170136120",
"213384372044977329916582447517652405552",
"108498142524791239269320721933275223985",
"28394362267748599337973718288173411729"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82722b453dc2f967b172603e389ee7dc1b3137cc",
"target": {
"file": "drivers/android/binder.c"
},
"signature_version": "v1",
"signature_type": "Line"
}
]