CVE-2024-36013: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect()
Extend a critical section to prevent chan from early freeing. Also make the l2capconnect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix.
Call stack summary:
[use] l2capbredrsigcmd l2capconnect ┌ mutexlock(&conn->chanlock); │ chan = pchan->ops->newconnection(pchan); <- alloc chan │ l2capchanadd(conn, chan); │ l2capchanhold(chan); │ listadd(&chan->list, &conn->chanl); ... (1) └ mutexunlock(&conn->chanlock); chan->confstate ... (4) <- use after free
[free] l2capconndel ┌ mutexlock(&conn->chanlock); │ foreach chan in conn->chanl: ... (2) │ l2capchanput(chan); │ l2capchandestroy │ kfree(chan) ... (3) <- chan freed └ mutexunlock(&conn->chanlock);
================================================================== BUG: KASAN: slab-use-after-free in instrumentatomicread include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in testbit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2capconnect+0xa67/0x11a0 net/bluetooth/l2capcore.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect()
The Linux kernel CVE team has assigned CVE-2024-36013 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052314-CVE-2024-36013-0c90@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
Linux kernel (Bluetooth L2CAP)to a version that resolves this vulnerability.Patch CVE-2024-36013 - Configuration
Change l2cap_connect() return type to void (instead of returning a pointer) to support backports and avoid returning a potentially freed pointer; ensure the compile break note is addressed by applying the corresponding code changes wherever l2cap_connect() is used.
Linux kernel Bluetooth L2CAP (l2cap_connect) l2cap_connect() return type = void - Compensating control
Apply the upstream mitigation for Bluetooth L2CAP slab-use-after-free: extend a critical section in l2cap_connect() to prevent chan from early freeing during channel allocation/initialization (as described: extend critical section around chan allocation and list addition to avoid slab-use-after-free).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36013?
CVE-2024-36013 has been assessed with a high severity level due to potential exploitation leading to memory corruption.
How do I fix CVE-2024-36013?
To fix CVE-2024-36013, update your Linux kernel to version 6.12.10-1 or 6.12.11-1 if you are using affected Debian packages.
Which versions of Linux are affected by CVE-2024-36013?
CVE-2024-36013 affects Linux kernel versions up to and including 5.10.226-1 and 6.1.123-1.
What types of vulnerabilities does CVE-2024-36013 address?
CVE-2024-36013 addresses a slab-use-after-free vulnerability in the Bluetooth L2CAP implementation.
Is there a workaround for CVE-2024-36013?
There is no known workaround for CVE-2024-36013, so upgrading the kernel is the recommended action.