CVE-2024-27398

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

When the sco connection is established and then, the sco socket

is releasing, timeout_work will be scheduled to judge whether

the sco disconnection is timeout. The sock will be deallocated

later, but it is dereferenced again in sco_sock_timeout. As a

result, the use-after-free bugs will happen. The root cause is

shown below:

Cleanup Thread | Worker Thread

sco_sock_release |

sco_sock_close |

__sco_sock_close |

sco_sock_set_timer |

schedule_delayed_work |

sco_sock_kill | (wait a time)

sock_put(sk) //FREE | sco_sock_timeout

| sock_hold(sk) //USE

The KASAN report triggered by POC is shown below:

[ 95.890016] ==================================================================

[ 95.890496]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References