In the Linux kernel, the following vulnerability has been resolved:
binder: signal epoll threads of self-work
In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDERWRITEREAD without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards.
It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work.
[ { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b372c39c40cbf179e56621e6bc48240943af69", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-1abf26e3", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97830f3c3088638ff90b20dfba2eb4d487bf14d7", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-30c5d154", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82722b453dc2f967b172603e389ee7dc1b3137cc", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-334097b4", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd64bb8329ce0ea27bc557e4160c2688835402ac", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-4b6c2741", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a423042052ec2bdbf1e552e621e6a768922363cc", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-60d4b512", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97830f3c3088638ff90b20dfba2eb4d487bf14d7", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-61390bc2", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd64bb8329ce0ea27bc557e4160c2688835402ac", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-66ca56ba", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ae586f6f6024f490b8546c8c84670f96bb9b68", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-7abe2297", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e09c016d72b91e76de25f71c7b93d94cc3c769", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-7dafba93", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42beab162dcee1e691ee4934292d51581c29df61", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-893ac51c", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e09c016d72b91e76de25f71c7b93d94cc3c769", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-8b287c95", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93b372c39c40cbf179e56621e6bc48240943af69", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-98c4bf25", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a423042052ec2bdbf1e552e621e6a768922363cc", "signature_type": "Function", "digest": { "length": 190.0, "function_hash": "116350721133535895225407234038268298661" }, "id": "CVE-2024-26606-b481ed5c", "target": { "file": "drivers/android/binder.c", "function": "binder_enqueue_thread_work_ilocked" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7ae586f6f6024f490b8546c8c84670f96bb9b68", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-ca33d9c7", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42beab162dcee1e691ee4934292d51581c29df61", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-cdb4bd4b", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82722b453dc2f967b172603e389ee7dc1b3137cc", "signature_type": "Line", "digest": { "line_hashes": [ "41504420359155318588145586819170136120", "213384372044977329916582447517652405552", "108498142524791239269320721933275223985", "28394362267748599337973718288173411729" ], "threshold": 0.9 }, "id": "CVE-2024-26606-eea2bb97", "target": { "file": "drivers/android/binder.c" }, "signature_version": "v1" } ]