CVE-2024-36012

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

Tying the msft->data lifetime to hdev by freeing it in

hci_release_dev() to fix the following case:

[use]

msft_do_close()

msft = hdev->msft_data;

if (!msft) ...(1) <- passed.

return;

mutex_lock(&msft->filter_lock); ...(4) <- used after freed.

[free]

msft_unregister()

msft = hdev->msft_data;

hdev->msft_data = NULL; ...(2)

kfree(msft); ...(3) <- msft is freed.

==================================================================

BUG: KASAN: slab-use-after-free in __mutex_lock_common

kernel/locking/mutex.c:587 [inline]

BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30

kernel/locking/mutex.c:752

Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References