cve/2023/CVE-2023-52609.md

### [CVE-2023-52609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52609)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=457b9a6f09f0%3C%2095b1d336b064%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

In the Linux kernel, the following vulnerability has been resolved:binder: fix race between mmput() and do_exit()Task A calls binder_update_page_range() to allocate and insert pages ona remote address space from Task B. For this, Task A pins the remote mmvia mmget_not_zero() first. This can race with Task B do_exit() and thefinal mmput() refcount decrement will come from Task A.  Task A            | Task B  ------------------+------------------  mmget_not_zero()  |                    |  do_exit()                    |    exit_mm()                    |      mmput()  mmput()           |    exit_mmap()     |      remove_vma()  |        fput()      |In this case, the work of ____fput() from Task B is queued up in Task Aas TWA_RESUME. So in theory, Task A returns to userspace and the cleanupwork gets executed. However, Task A instead sleep, waiting for a replyfrom Task B that never comes (it's dead).This means the binder_deferred_release() is blocked until an unrelatedbinder event forces Task A to go back to userspace. All the associateddeath notifications will also be delayed until then.In order to fix this use mmput_async() that will schedule the work inthe corresponding mm->async_put_work WQ instead of Task A.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/NaInSec/CVE-LIST