CVE-2024-36013: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
First published: Thu May 23 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=3.0<6.6.32 | |
| Linux Kernel | >=6.7<6.8.11 | |
| Linux Kernel | =6.9-rc1 | |
| Linux Kernel | =6.9-rc2 | |
| Linux Kernel | =6.9-rc3 | |
| Linux Kernel | =6.9-rc4 | |
| Linux Kernel | =6.9-rc5 | |
| Linux Kernel | =6.9-rc6 | |
| Linux Kernel | =6.9-rc7 | |
| debian/linux | <=5.10.223-1<=5.10.234-1<=6.1.129-1<=6.1.128-1 | 6.12.21-1 6.12.22-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2024/05/30/1
- http://www.openwall.com/lists/oss-security/2024/05/30/2
- https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658
- https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6
- https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5
- https://launchpad.net/bugs/cve/CVE-2024-36013
- https://git.kernel.org/linus/4d7b41c0e43995b0e992b9f8903109275744b658
- https://security-tracker.debian.org/tracker/CVE-2024-36013
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36013
- https://nvd.nist.gov/vuln/detail/CVE-2024-36013
- https://ubuntu.com/security/CVE-2024-36013
Frequently Asked Questions
What is the severity of CVE-2024-36013?
CVE-2024-36013 has been assessed with a high severity level due to potential exploitation leading to memory corruption.
How do I fix CVE-2024-36013?
To fix CVE-2024-36013, update your Linux kernel to version 6.12.10-1 or 6.12.11-1 if you are using affected Debian packages.
Which versions of Linux are affected by CVE-2024-36013?
CVE-2024-36013 affects Linux kernel versions up to and including 5.10.226-1 and 6.1.123-1.
What types of vulnerabilities does CVE-2024-36013 address?
CVE-2024-36013 addresses a slab-use-after-free vulnerability in the Bluetooth L2CAP implementation.
Is there a workaround for CVE-2024-36013?
There is no known workaround for CVE-2024-36013, so upgrading the kernel is the recommended action.
- agent/title
- agent/type
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- agent/weakness
- collector/launchpad-cve
- source/Launchpad
- agent/remedy
- agent/first-publish-date
- agent/author
- agent/references
- collector/nvd-cve
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-api
- package-manager/debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/3.0
- version/linux kernel/6.7
- version/linux kernel/6.9-rc1
- version/linux kernel/6.9-rc2
- version/linux kernel/6.9-rc3
- version/linux kernel/6.9-rc4
- version/linux kernel/6.9-rc5
- version/linux kernel/6.9-rc6
- version/linux kernel/6.9-rc7