CVE-2024-26801

2024-04-0400:00:00

ubuntu.com

linux kernel

cve-2024-26801

bluetooth

use-after-free

hci_error_reset

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.2%

JSON

In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Avoid potential use-after-free in hci_error_reset While handling
the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not
responding, the GPIO reset mechanism would free the hci_dev and lead to a
use-after-free in hci_error_reset. Here’s the call trace observed on a
ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c
__hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ?
init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a
6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>]
process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152
? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30
This patch holds the reference count on the hci_dev while processing a
HCI_EV_HARDWARE_ERROR event to avoid potential crash.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-225.237UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-186.206UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-112.122UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-35.35UNKNOWN
ubuntu24.04noarchlinux< anyUNKNOWN
ubuntu14.04noarchlinux< anyUNKNOWN
ubuntu16.04noarchlinux< 4.4.0-254.288UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1168.181UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1126.136UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1063.69UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-225.237	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-186.206	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-112.122	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-35.35	UNKNOWN
ubuntu	24.04	noarch	linux	< any	UNKNOWN
ubuntu	14.04	noarch	linux	< any	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-254.288	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1168.181	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1126.136	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1063.69	UNKNOWN