CVE-2024-21803 Possible UAF in bt_accept_poll in Linux kernel

2024-01-3007:15:33

CWE-416

Anolis

www.cve.org

cve-2024-21803

use after free

bt_accept_poll

linux kernel

local execution of code

bluetooth modules

arm

x86

vulnerability

gitee.com

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

0.0004 Low

EPSS

Percentile

5.1%

JSON

Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.

This issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.

CNA Affected

[
  {
    "collectionURL": "https://kernel.org/",
    "defaultStatus": "unaffected",
    "modules": [
      "bluetooth"
    ],
    "packageName": "kernel",
    "platforms": [
      "Linux",
      "x86",
      "ARM"
    ],
    "product": "Linux kernel",
    "programFiles": [
      "https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.c"
    ],
    "repo": "https://gitee.com/anolis/cloud-kernel.git",
    "vendor": "Linux",
    "versions": [
      {
        "lessThan": "v6.8-rc1",
        "status": "affected",
        "version": "v2.6.12-rc2",
        "versionType": "custom"
      }
    ]
  }
]