CVE-2024-41063: Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: cancel all works upon hciunregisterdev()
syzbot is reporting that calling hcireleasedev() from hcierrorreset() due to hcidevput() from hcierrorreset() can cause deadlock at destroyworkqueue(), for hcierrorreset() is called from hdev->reqworkqueue which destroyworkqueue() needs to flush.
We need to make sure that hdev->{rxwork,cmdwork,txwork} which are queued into hdev->workqueue and hdev->{poweron,errorreset} which are queued into hdev->reqworkqueue are no longer running by the moment
destroyworkqueue(hdev->workqueue); destroyworkqueue(hdev->reqworkqueue);
are called from hcireleasedev().
Call cancelworksync() on these work items from hciunregisterdev() as soon as hdev->list is removed from hcidevlist.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41063?
CVE-2024-41063 has been classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-41063?
To mitigate CVE-2024-41063, update your Linux kernel to version 4.19.319, 5.4.281, 5.10.223, 5.15.164, 6.1.101, or higher as per the release notes.
Which versions of the Linux kernel are affected by CVE-2024-41063?
Versions below 4.19.319, 5.4.281, 5.10.223, 5.15.164, and 6.1.101 of the Linux kernel are affected by CVE-2024-41063.
What systems are impacted by CVE-2024-41063?
CVE-2024-41063 impacts systems running vulnerable versions of the Linux kernel across various distributions.
Is CVE-2024-41063 being actively exploited?
As of now, there is no public information indicating that CVE-2024-41063 is actively being exploited in the wild.