CVE-2024-36012: Bluetooth: msft: fix slab-use-after-free in msft_do_close()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: msft: fix slab-use-after-free in msftdoclose()
The Linux kernel CVE team has assigned CVE-2024-36012 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052314-CVE-2024-36012-3062@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: msft: fix slab-use-after-free in msftdoclose()
Tying the msft->data lifetime to hdev by freeing it in hcireleasedev() to fix the following case:
[use] msftdoclose() msft = hdev->msftdata; if (!msft) ...(1) <- passed. return; mutexlock(&msft->filterlock); ...(4) <- used after freed.
[free] msftunregister() msft = hdev->msftdata; hdev->msftdata = NULL; ...(2) kfree(msft); ...(3) <- msft is freed.
================================================================== BUG: KASAN: slab-use-after-free in mutexlockcommon kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in mutexlock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.91 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.31 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.10 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 25 April 2025 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-36012
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36012?
CVE-2024-36012 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-36012?
To fix CVE-2024-36012, update to a patched version of the Linux kernel, specifically to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, or 6.12.12-1.
What versions of the Linux kernel are affected by CVE-2024-36012?
CVE-2024-36012 affects Linux kernel versions between 5.12 and 6.1.91, as well as several specific versions up to 6.9-rc7.
What is the cause of CVE-2024-36012?
CVE-2024-36012 is caused by a slab-use-after-free vulnerability in the Bluetooth functionality within the Linux kernel.
Is there a workaround for CVE-2024-36012?
Currently, there is no documented workaround for CVE-2024-36012; updating the kernel is the recommended approach.