CVE-2024-36012

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36012
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac Patch
https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 Patch
https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 Patch
https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 Patch
https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac Patch
https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 Patch
https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 Patch
https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
History

06 Jan 2025, 22:33

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac - () https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac - Patch
References () https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 - () https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 - Patch
References () https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 - () https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 - Patch
References () https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 - () https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac - () https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac -
References () https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 - () https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 -
References () https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 - () https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 -
References () https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 - () https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: msft: corrija slab-use-after-free en msft_do_close() Vinculando la vida útil de msft-&gt;data a hdev liberándolo en hci_release_dev() para solucionar el siguiente caso: [usar] msft_do_close() msft = hdev-&gt;msft_data; if (!msft) ...(1) &lt;- aprobado. devolver; mutex_lock(&amp;msft-&gt;filter_lock); ...(4) &lt;- usado después de liberado. [gratis] msft_unregister() msft = hdev-&gt;msft_data; hdev-&gt;msft_data = NULL; ...(2) klibre(msft); ...(3) &lt;- se libera msft. ==================================================== ================ ERROR: KASAN: slab-use-after-free en __mutex_lock_common kernel/locking/mutex.c:587 [en línea] ERROR: KASAN: slab-use-after -free en __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Lectura de tamaño 8 en addr ffff888106cbbca8 por tarea kworker/u5:2/309

23 May 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-23 07:15

Updated : 2025-01-06 22:33

NVD link : CVE-2024-36012

Mitre link : CVE-2024-36012

CVE.ORG link : CVE-2024-36012

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free