cve-2024-41062
Vulnerability from cvelistv5
Published
2024-07-29 14:57
Modified
2024-12-19 09:11
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data. Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
   Linux Linux Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:52.343Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:22:05.690775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:59.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "605572e64cd9cebb05ed609d96cff05b50d18cdf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b803f30ea23e0968b6c8285c42adf0d862ab2bf6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3b732449b78183d17178db40be3a4401cf3cd629",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "89e856e124f9ae548572c56b1b70c2255705f8fe",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n           CPU0                       CPU1\n           ----                       ----\n           sock_close                 hci_rx_work\n\t   l2cap_sock_release         hci_acldata_packet\n\t   l2cap_sock_kill            l2cap_recv_frame\n\t   sk_free                    l2cap_conless_channel\n\t                              l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:11:10.596Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"
        },
        {
          "url": "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"
        }
      ],
      "title": "bluetooth/l2cap: sync sock recv cb and release",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41062",
    "datePublished": "2024-07-29T14:57:24.352Z",
    "dateReserved": "2024-07-12T12:17:45.627Z",
    "dateUpdated": "2024-12-19T09:11:10.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41062\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:14.173\",\"lastModified\":\"2024-11-21T09:32:10.077\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbluetooth/l2cap: sync sock recv cb and release\\n\\nThe problem occurs between the system call to close the sock and hci_rx_work,\\nwhere the former releases the sock and the latter accesses it without lock protection.\\n\\n           CPU0                       CPU1\\n           ----                       ----\\n           sock_close                 hci_rx_work\\n\\t   l2cap_sock_release         hci_acldata_packet\\n\\t   l2cap_sock_kill            l2cap_recv_frame\\n\\t   sk_free                    l2cap_conless_channel\\n\\t                              l2cap_sock_recv_cb\\n\\nIf hci_rx_work processes the data that needs to be received before the sock is\\nclosed, then everything is normal; Otherwise, the work thread may access the\\nreleased sock when receiving data.\\n\\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\\nthe sock release and recv cb.\\n\\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: bluetooth/l2cap: sync sock recv cb and release El problema ocurre entre la llamada al sistema para cerrar el calcet\u00edn y hci_rx_work, donde el primero libera el calcet\u00edn y el segundo accede a \u00e9l sin protecci\u00f3n de bloqueo. . CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb Si hci_rx_work procesa los datos que deben recibirse antes de cerrar el sock, entonces todo es normal; De lo contrario, el hilo de trabajo puede acceder al sock liberado al recibir datos. Agregue un mutex chan en la devoluci\u00f3n de llamada rx del sock para lograr la sincronizaci\u00f3n entre la liberaci\u00f3n del sock y recv cb. Sock est\u00e1 muerto, as\u00ed que configure los datos de chan en NULL, evite que otros usen un puntero de sock no v\u00e1lido.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:52.343Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41062\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:22:05.690775Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:13.945Z\"}}], \"cna\": {\"title\": \"bluetooth/l2cap: sync sock recv cb and release\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"605572e64cd9cebb05ed609d96cff05b50d18cdf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"b803f30ea23e0968b6c8285c42adf0d862ab2bf6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"3b732449b78183d17178db40be3a4401cf3cd629\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\", \"lessThan\": \"89e856e124f9ae548572c56b1b70c2255705f8fe\", \"versionType\": \"git\"}], \"programFiles\": [\"net/bluetooth/l2cap_sock.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.1.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bluetooth/l2cap_sock.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf\"}, {\"url\": \"https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6\"}, {\"url\": \"https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629\"}, {\"url\": \"https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbluetooth/l2cap: sync sock recv cb and release\\n\\nThe problem occurs between the system call to close the sock and hci_rx_work,\\nwhere the former releases the sock and the latter accesses it without lock protection.\\n\\n           CPU0                       CPU1\\n           ----                       ----\\n           sock_close                 hci_rx_work\\n\\t   l2cap_sock_release         hci_acldata_packet\\n\\t   l2cap_sock_kill            l2cap_recv_frame\\n\\t   sk_free                    l2cap_conless_channel\\n\\t                              l2cap_sock_recv_cb\\n\\nIf hci_rx_work processes the data that needs to be received before the sock is\\nclosed, then everything is normal; Otherwise, the work thread may access the\\nreleased sock when receiving data.\\n\\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\\nthe sock release and recv cb.\\n\\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:11:10.596Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41062\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:11:10.596Z\", \"dateReserved\": \"2024-07-12T12:17:45.627Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:57:24.352Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.