CVE-2024-26890

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: fix out of bounds memory access

The problem is detected by KASAN.

btrtl driver uses private hci data to store 'struct btrealtek_data'.

If btrtl driver is used with btusb, then memory for private hci data

is allocated in btusb. But no private data is allocated after hci_dev,

when btrtl is used with hci_h5.

This commit adds memory allocation for hci_h5 case.

==================================================================

BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]

Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76

Hardware name: Pine64 PinePhone (1.2) (DT)

Workqueue: hci0 hci_power_on [bluetooth]

Call trace:

dump_backtrace+0x9c/0x128

show_stack+0x20/0x38

dump_stack_lvl+0x48/0x60

print_report+0xf8/0x5d8

kasan_report+0x90/0xd0

__asan_store8+0x9c/0xc0

[btrtl]

h5_btrtl_setup+0xd0/0x2f8 [hci_uart]

h5_setup+0x50/0x80 [hci_uart]

hci_u

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References