CVE-2024-26890: Bluetooth: btrtl: fix out of bounds memory access
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: fix out of bounds memory access
The Linux kernel CVE team has assigned CVE-2024-26890 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041742-CVE-2024-26890-4239@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: fix out of bounds memory access
The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtekdata'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hcidev, when btrtl is used with hcih5.
This commit adds memory allocation for hcih5 case.
================================================================== BUG: KASAN: slab-out-of-bounds in btrtlinitialize+0x6cc/0x958 [btrtl] Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76
Hardware name: Pine64 PinePhone (1.2) (DT) Workqueue: hci0 hcipoweron [bluetooth] Call trace: dumpbacktrace+0x9c/0x128 showstack+0x20/0x38 dumpstacklvl+0x48/0x60 printreport+0xf8/0x5d8 kasanreport+0x90/0xd0 asanstore8+0x9c/0xc0 [btrtl] h5btrtlsetup+0xd0/0x2f8 [hciuart] h5setup+0x50/0x80 [hciuart] hciuartsetup+0xd4/0x260 [hciuart] hcidevopensync+0x1cc/0xf68 [bluetooth] hcidevdoopen+0x34/0x90 [bluetooth] hcipoweron+0xc4/0x3c8 [bluetooth] processonework+0x328/0x6f0 workerthread+0x410/0x778 kthread+0x168/0x178 retfromfork+0x10/0x20
Allocated by task 53: kasansavestack+0x3c/0x68 kasansavetrack+0x20/0x40 kasansaveallocinfo+0x68/0x78 kasankmalloc+0xd4/0xd8 kmalloc+0x1b4/0x3b0 hciallocdevpriv+0x28/0xa58 [bluetooth] hciuartregisterdevice+0x118/0x4f8 [hciuart] h5serdevprobe+0xf4/0x178 [hciuart] serdevdrvprobe+0x54/0xa0 reallyprobe+0x254/0x588 driverprobedevice+0xc4/0x210 driverprobedevice+0x64/0x160 driverattachasynchelper+0x88/0x158 asyncrunentryfn+0xd0/0x388 processonework+0x328/0x6f0 workerthread+0x410/0x778 kthread+0x168/0x178 retfromfork+0x10/0x20
Last potentially related work creation: kasansavestack+0x3c/0x68 kasanrecordauxstack+0xb0/0x150 kasanrecordauxstacknoalloc+0x14/0x20 queuework+0x33c/0x960 queueworkon+0x98/0xc0 hcirecvframe+0xc8/0x1e8 [bluetooth] h5completerxpkt+0x2c8/0x800 [hciuart] h5rxpayload+0x98/0xb8 [hciuart] h5recv+0x158/0x3d8 [hciuart] hciuartreceivebuf+0xa0/0xe8 [hciuart] ttyportreceivebuf+0xac/0x178 flushtoldisc+0x130/0x2c8 processonework+0x328/0x6f0 workerthread+0x410/0x778 kthread+0x168/0x178 retfromfork+0x10/0x20
Second to last potentially related work creation: kasansavestack+0x3c/0x68 kasanrecordauxstack+0xb0/0x150 kasanrecordauxstacknoalloc+0x14/0x20 queuework+0x788/0x960 queueworkon+0x98/0xc0 hcicmdsyncsk+0x23c/0x7a0 [bluetooth] hcicmdsync+0x24/0x38 [bluetooth] btrtlinitialize+0x760/0x958 [btrtl] h5btrtlsetup+0xd0/0x2f8 [hciuart] h5setup+0x50/0x80 [hciuart] hciuartsetup+0xd4/0x260 [hciuart] hcidevopensync+0x1cc/0xf68 [bluetooth] hcidevdoopen+0x34/0x90 [bluetooth] hcipoweron+0xc4/0x3c8 [bluetooth] processonework+0x328/0x6f0 workerthread+0x410/0x778 kthread+0x168/0x178 retfromfork+0x10/0x20 ==================================================================
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-26890
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26890?
CVE-2024-26890 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26890?
To fix CVE-2024-26890, update the Linux kernel to one of the patched versions provided by your distribution, such as kernel 6.6.23 or higher.
What does CVE-2024-26890 affect?
CVE-2024-26890 affects specific versions of the Linux kernel, specifically those prior to the patched releases mentioned in the advisory.
What are the potential consequences of CVE-2024-26890?
Exploiting CVE-2024-26890 could lead to out-of-bounds memory access, which may result in system instability or denial of service.
Is CVE-2024-26890 already patched?
Yes, CVE-2024-26890 has been patched in various Linux kernel versions, and users are encouraged to update their systems.