LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50240: android: binder: stop saving a pointer to the VMA

In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with. Instead, change the binder_alloc struct to record the start address of the VMA and use vma_lookup() to get the vma when needed. Add lockdep mmap_lock checks on updates to the vma pointer to ensure the lock is held and depend on that lock for synchronization of readers and writers - which was already the case anyways, so the smp_wmb()/smp_rmb() was not necessary. [akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in the Android Binder memory-management code. The kernel could keep using a memory-area pointer after it became invalid. Public sources do not state real-world exploitation, business impact, or a CVSS score, so urgency depends on whether your kernels include and expose Binder functionality.

Executive priority

Treat as a normal-priority kernel remediation item unless Binder is broadly exposed in your environment. There is no cited active exploitation, but kernel memory-safety flaws can become serious if reachable.

Technical view

The Binder allocator stored a VMA pointer outside mmap_lock and reused it later. The VMA could be freed or become stale during setup or later VMA operations. The fix records the VMA start address and performs vma_lookup() when needed, with mmap_lock checks for synchronization.

Likely exposure

Exposure is most relevant to Linux kernels with the Android Binder driver present and reachable. The CVE record lists Linux as affected with versions including 4.20, 5.4.224, 5.10.154, 5.15.61, 5.18.18, 5.19.2, and 6.0, but exact vendor package ranges require confirmation.

Exploitation context

No CISA KEV listing or cited source indicates active exploitation. The public record does not provide exploitability details, required privileges, or impact beyond the unsafe stale VMA pointer condition in kernel Binder code.

Researcher notes

The record lacks CVSS, CWE, and detailed impact. Analysis should focus on the Binder allocator VMA lifetime issue and whether downstream vendor kernels backported the stable commits. Avoid assuming exploitability without additional vendor or researcher evidence.

Mitigation direction

  • Apply a vendor kernel update that includes the referenced stable Binder fixes.
  • Prioritize systems where Android Binder is enabled or used.
  • If no vendor fix is available, follow vendor guidance and assess Binder exposure.

Validation and detection

  • Inventory running kernel versions on Linux and Android-derived systems.
  • Check whether Android Binder support is enabled and reachable.
  • Verify kernel changelogs include one of the referenced stable commit IDs.
  • Track vendor advisories for package-specific affected and fixed versions.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50240 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdd2283f2605e3b3e9c61bcae844b34f2afa4813f, dd2283f2605e3b3e9c61bcae844b34f2afa4813f, dd2283f2605e3b3e9c61bcae844b34f2afa4813f, dd2283f2605e3b3e9c61bcae844b34f2afa4813f, dd2283f2605e3b3e9c61bcae844b34f2afa4813f, dd2283f2605e3b3e9c61bcae844b34f2afa4813funaffected
LinuxLinux4.20, 0, 5.4.224, 5.10.154, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.