CVE-2024-56653

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56653
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56653.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-56653
Related
Published
2024-12-27T15:15:25Z
Modified
2025-01-08T09:44:22.856882Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtk: avoid UAF in btmtkprocesscoredump

hcidevcdappend may lead to the release of the skb, so it cannot be accessed once it is called.

================================================================== BUG: KASAN: slab-use-after-free in btmtkprocesscoredump+0x2a7/0x2d0 [btmtk] Read of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82

CPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G U 6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c Hardware name: Google YaviksUfs/YaviksUfs, BIOS GoogleYaviksUfs.15217.552.0 05/07/2024 Workqueue: events btusbrxwork [btusb] Call Trace: <TASK> dumpstacklvl+0xfd/0x150 printreport+0x131/0x780 kasanreport+0x177/0x1c0 btmtkprocesscoredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01] btusbrecvaclmtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] btusbrxwork+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] workerthread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 retfromfork+0x51/0x80 retfromfork_asm+0x1b/0x30 </TASK>

Allocated by task 82: stacktracesave+0xdc/0x190 kasansettrack+0x4e/0x80 _kasanslaballoc+0x4e/0x60 kmemcachealloc+0x19f/0x360 skbclone+0x132/0xf70 btusbrecvaclmtk+0x104/0x1a0 [btusb] btusbrxwork+0x9e/0xe0 [btusb] workerthread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 retfromfork+0x51/0x80 retfromfork_asm+0x1b/0x30

Freed by task 1733: stacktracesave+0xdc/0x190 kasansettrack+0x4e/0x80 kasansavefreeinfo+0x28/0xb0 __kasanslabfree+0xfd/0x170 kmemcachefree+0x183/0x3f0 hcidevcdrx+0x91a/0x2060 [bluetooth] workerthread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 retfromfork+0x51/0x80 retfromfork_asm+0x1b/0x30

The buggy address belongs to the object at ffff888033cfab40 which belongs to the cache skbuffheadcache of size 232 The buggy address is located 112 bytes inside of freed 232-byte region [ffff888033cfab40, ffff888033cfac28)

The buggy address belongs to the physical page: page:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa head:00000000a174ba93 order:1 entiremapcount:0 nrpagesmapped:0 pincount:0 anon flags: 0x4000000000000840(slab|head|zone=1) pagetype: 0xffffffff() raw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb

ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc

ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Check if we need to call hcidevcdcomplete before calling hcidevcdappend. That requires that we check data->cdinfo.cnt >= MTKCOREDUMPNUM instead of data->cdinfo.cnt > MTKCOREDUMPNUM, as we increment data->cdinfo.cnt only once the call to hcidevcd_append succeeds.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.6-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}