CVE-2024-41063: Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: cancel all works upon hciunregisterdev()
syzbot is reporting that calling hcireleasedev() from hcierrorreset() due to hcidevput() from hcierrorreset() can cause deadlock at destroyworkqueue(), for hcierrorreset() is called from hdev->reqworkqueue which destroyworkqueue() needs to flush.
We need to make sure that hdev->{rxwork,cmdwork,txwork} which are queued into hdev->workqueue and hdev->{poweron,errorreset} which are queued into hdev->reqworkqueue are no longer running by the moment
destroyworkqueue(hdev->workqueue); destroyworkqueue(hdev->reqworkqueue);
are called from hcireleasedev().
Call cancelworksync() on these work items from hciunregisterdev() as soon as hdev->list is removed from hcidevlist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.319 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.281 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.223 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.164 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.101 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.42 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.106-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.11-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In hci_unregister_dev(), immediately after removing hdev->list from hci_dev_list, call cancel_work_sync() for hdev->{rx_work,cmd_work,tx_work,power_on,error_reset} before hci_release_dev() destroys hdev->workqueue and hdev->req_workqueue.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41063?
CVE-2024-41063 has been classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-41063?
To mitigate CVE-2024-41063, update your Linux kernel to version 4.19.319, 5.4.281, 5.10.223, 5.15.164, 6.1.101, or higher as per the release notes.
Which versions of the Linux kernel are affected by CVE-2024-41063?
Versions below 4.19.319, 5.4.281, 5.10.223, 5.15.164, and 6.1.101 of the Linux kernel are affected by CVE-2024-41063.
What systems are impacted by CVE-2024-41063?
CVE-2024-41063 impacts systems running vulnerable versions of the Linux kernel across various distributions.
Is CVE-2024-41063 being actively exploited?
As of now, there is no public information indicating that CVE-2024-41063 is actively being exploited in the wild.