CVE-2024-50077: Bluetooth: ISO: Fix multiple init when debugfs is disabled
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix multiple init when debugfs is disabled
If btdebugfs is not created successfully, which happens if either CONFIGDEBUGFS or CONFIGDEBUGFSALLOWALL is unset, then isoinit() returns early and does not set isoinited to true. This means that a subsequent call to isoinit() will result in duplicate calls to protoregister(), btsockregister(), etc.
With CONFIGLISTHARDENED and CONFIGBUGONDATACORRUPTION enabled, the duplicate call to protoregister() triggers this BUG():
listadd double add: new=ffffffffc0b280d0, prev=ffffffffbab56250, next=ffffffffc0b280d0. ------------[ cut here ]------------ kernel BUG at lib/listdebug.c:35! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1 RIP: 0010:listaddvalidorreport+0x9a/0xa0 ... listaddvalidorreport+0x9a/0xa0 protoregister+0x2b5/0x340 isoinit+0x23/0x150 [bluetooth] setisosocketfunc+0x68/0x1b0 [bluetooth] kmemcachefree+0x308/0x330 hcisocksendmsg+0x990/0x9e0 [bluetooth] socksendmsg+0x7b/0x80 sockwriteiter+0x9a/0x110 doiterreadvwritev+0x11d/0x220 vfswritev+0x180/0x3e0 dowritev+0xca/0x100 ...
This change removes the early return. The check for isodebugfs being NULL was unnecessary, it is always NULL when isoinited is false.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50077?
CVE-2024-50077 is classified with a severity rating that indicates potential risks in certain Linux kernel versions.
How do I fix CVE-2024-50077?
To fix CVE-2024-50077, users should upgrade to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50077?
CVE-2024-50077 affects multiple versions of the Linux kernel ranging from 6.0 up to 6.12-rc3.
Is CVE-2024-50077 related to Bluetooth functionality in the Linux kernel?
Yes, CVE-2024-50077 pertains to a flaw in the Bluetooth ISO implementation of the Linux kernel.
What happens if debugfs is not created successfully in relation to CVE-2024-50077?
If debugfs is not created successfully, the iso_init() function returns early, potentially affecting Bluetooth operations.