LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49947: binder: fix alloc->vma_vm_mm null-ptr dereference

In the Linux kernel, the following vulnerability has been resolved: binder: fix alloc->vma_vm_mm null-ptr dereference Syzbot reported a couple issues introduced by commit 44e602b4e52f ("binder_alloc: add missing mmap_lock calls when using the VMA"), in which we attempt to acquire the mmap_lock when alloc->vma_vm_mm has not been initialized yet. This can happen if a binder_proc receives a transaction without having previously called mmap() to setup the binder_proc->alloc space in [1]. Also, a similar issue occurs via binder_alloc_print_pages() when we try to dump the debugfs binder stats file in [2]. Sample of syzbot's crash report: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] CPU: 0 PID: 3755 Comm: syz-executor229 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 syz-executor229[3755] cmdline: ./syz-executor2294415195 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:__lock_acquire+0xd83/0x56d0 kernel/locking/lockdep.c:4923 [...] Call Trace: <TASK> lock_acquire kernel/locking/lockdep.c:5666 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631 down_read+0x98/0x450 kernel/locking/rwsem.c:1499 mmap_read_lock include/linux/mmap_lock.h:117 [inline] binder_alloc_new_buf_locked drivers/android/binder_alloc.c:405 [inline] binder_alloc_new_buf+0xa5/0x19e0 drivers/android/binder_alloc.c:593 binder_transaction+0x242e/0x9a80 drivers/android/binder.c:3199 binder_thread_write+0x664/0x3220 drivers/android/binder.c:3986 binder_ioctl_write_read drivers/android/binder.c:5036 [inline] binder_ioctl+0x3470/0x6d00 drivers/android/binder.c:5323 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] ================================================================== Fix these issues by setting up alloc->vma_vm_mm pointer during open() and caching directly from current->mm. This guarantees we have a valid reference to take the mmap_lock during scenarios described above. [1] https://syzkaller.appspot.com/bug?extid=f7dc54e5be28950ac459 [2] https://syzkaller.appspot.com/bug?extid=a75ebe0452711c9e56d9

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel Binder driver crash bug. Under specific Binder allocation states, the kernel may dereference a null pointer and crash. The source bundle does not show data theft, privilege escalation, CVSS scoring, or active exploitation evidence.

Executive priority

Treat as a kernel stability and availability issue, not a confirmed breach vector from the provided evidence. Patch through normal kernel maintenance, with higher urgency for shared, Android-derived, or multi-user systems exposing Binder.

Technical view

The bug is a null-pointer dereference in Android Binder allocation code after mmap_lock handling was added. alloc->vma_vm_mm could be unset when a Binder process receives a transaction before mmap setup, or when Binder debugfs stats are dumped. The fix initializes alloc->vma_vm_mm during open() from current->mm.

Likely exposure

Exposure is most relevant to Linux kernels with the Binder driver enabled and affected kernel commits or builds. The bundle names Linux, commit identifiers, and versions 5.15.64 and 5.19.6, but does not provide a complete product matrix.

Exploitation context

No active exploitation is supported by the provided sources, and KEV is false. Evidence comes from syzbot crash reports and kernel stable fixes. The known impact in the bundle is kernel null-pointer dereference, likely denial of service.

Researcher notes

The source bundle is incomplete for precise affected ranges and scoring. It identifies the vulnerable condition and fix rationale, but provides no CVSS, CWE, exploitability assessment, or confirmed attack reports. Avoid claiming remote exposure without product-specific evidence.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fixes.
  • For custom kernels, review and backport the referenced Binder commits.
  • Check Linux or device vendor advisories for exact affected build ranges.
  • Prioritize systems where Binder is enabled and reachable by untrusted local users.

Validation and detection

  • Inventory kernel versions, vendor builds, and Binder driver availability.
  • Compare deployed kernels against the referenced stable commit fixes.
  • Review kernel crash logs for Binder null-pointer dereference patterns.
  • Confirm vendor advisories map this CVE to your distribution packages.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49947 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux577d9c05cc48c5242bcf719c06a5baf3105473ad, 7b0163c1b07b7ff1717aa975821c40df98786ddc, 44e602b4e52f70f04620bbbf4fe46ecb40170bdeunaffected
LinuxLinux5.15.64, 5.19.6unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.