CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix UAF on isosocktimeout
conn->sk maybe have been unlinked/freed while waiting for isoconnlock so this checks if the conn->sk is still valid by checking if it part of isosklist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50124?
CVE-2024-50124 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-50124?
To fix CVE-2024-50124, upgrade the Linux kernel to a version where the vulnerability has been patched.
What systems are affected by CVE-2024-50124?
CVE-2024-50124 affects multiple versions of the Linux kernel, including 6.0 to 6.1.115, 6.2 to 6.6.59, and the 6.12 release candidates.
What types of attacks does CVE-2024-50124 allow?
CVE-2024-50124 may allow unauthorized access or manipulation of Bluetooth connections due to a use-after-free condition.
Is CVE-2024-50124 a critical vulnerability?
No, CVE-2024-50124 is not considered a critical vulnerability but still requires timely remediation.