CVE-2024-35850

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35850
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev setup Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when setup() is called for a non-serdev controller.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 Patch
https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86 Patch
https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 Patch
https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 Patch
https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86 Patch
https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
History

30 Dec 2024, 17:42

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE CWE-476
References () https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 - () https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 - Patch
References () https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86 - () https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86 - Patch
References () https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 - () https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 - Patch

21 Nov 2024, 09:21

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: qca: corrige NULL-deref en configuración sin serdev. Los controladores Qualcomm ROME se pueden registrar desde la disciplina de línea Bluetooth y en este caso el puntero HCI UART serdev es NULL. Agregue la verificación de sanidad que falta para evitar una desreferencia del puntero NULL cuando se llama a setup() para un controlador que no es serdev.
References () https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 - () https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 -
References () https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86 - () https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86 -
References () https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 - () https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 -

17 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 15:15

Updated : 2024-12-30 17:42

NVD link : CVE-2024-35850

Mitre link : CVE-2024-35850

CVE.ORG link : CVE-2024-35850

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference