CVE-2024-50078: Bluetooth: Call iso_exit() on module unload
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Call isoexit() on module unload
If isoinit() has been called, isoexit() must be called on module unload. Without that, the struct proto that isoinit() registered with protoregister() becomes invalid, which could cause unpredictable problems later. In my case, with CONFIGLISTHARDENED and CONFIGBUGONDATACORRUPTION enabled, loading the module again usually triggers this BUG():
listadd corruption. next->prev should be prev (ffffffffb5355fd0), but was 0000000000000068. (next=ffffffffc0a010d0). ------------[ cut here ]------------ kernel BUG at lib/listdebug.c:29! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 4159 Comm: modprobe Not tainted 6.10.11-4+bt2-ao-desktop #1 RIP: 0010:listaddvalidorreport+0x61/0xa0 ... listaddvalidorreport+0x61/0xa0 protoregister+0x299/0x320 hcisockinit+0x16/0xc0 [bluetooth] btinit+0x68/0xd0 [bluetooth] pfxbtinit+0x10/0x10 [bluetooth] dooneinitcall+0x80/0x2f0 doinitmodule+0x8b/0x230 dosysinitmodule+0x15f/0x190 dosyscall64+0x68/0x110 ...
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Call isoexit() on module unload
If isoinit() has been called, isoexit() must be called on module unload. Without that, the struct proto that isoinit() registered with protoregister() becomes invalid, which could cause unpredictable problems later. In my case, with CONFIGLISTHARDENED and CONFIGBUGONDATACORRUPTION enabled, loading the module again usually triggers this BUG():
listadd corruption. next->prev should be prev (ffffffffb5355fd0), but was 0000000000000068. (next=ffffffffc0a010d0). ------------[ cut here ]------------ kernel BUG at lib/listdebug.c:29! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 4159 Comm: modprobe Not tainted 6.10.11-4+bt2-ao-desktop #1 RIP: 0010:listaddvalidorreport+0x61/0xa0 ... listaddvalidorreport+0x61/0xa0 protoregister+0x299/0x320 hcisockinit+0x16/0xc0 [bluetooth] btinit+0x68/0xd0 [bluetooth] pfxbtinit+0x10/0x10 [bluetooth] dooneinitcall+0x80/0x2f0 doinitmodule+0x8b/0x230 dosysinitmodule+0x15f/0x190 dosyscall64+0x68/0x110 ...
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50078?
CVE-2024-50078 has been classified with a moderate severity rating due to potential denial of service issues associated with module unload in the Linux kernel.
How do I fix CVE-2024-50078?
To address CVE-2024-50078, ensure that iso_exit() is called on module unload if iso_init() has been previously invoked.
Which versions of the Linux kernel are affected by CVE-2024-50078?
CVE-2024-50078 affects various versions of the Linux kernel between 6.0 and 6.1.114, between 6.2 and 6.6.58, and between 6.7 and 6.11.5, as well as specific release candidates like 6.12-rc1 to 6.12-rc3.
What are the potential consequences of CVE-2024-50078?
The consequences of CVE-2024-50078 may include instability or crashes in Bluetooth functionalities due to improper handling of module unload sequences.
Is there a workaround for CVE-2024-50078?
Currently, the best practice is to apply the appropriate patches provided for CVE-2024-50078 rather than seeking workarounds.