CVE-2024-50077

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix multiple init when debugfs is disabled

If bt_debugfs is not created successfully, which happens if either

CONFIG_DEBUG_FS or CONFIG_DEBUG_FS_ALLOW_ALL is unset, then iso_init()

returns early and does not set iso_inited to true. This means that a

subsequent call to iso_init() will result in duplicate calls to

proto_register(), bt_sock_register(), etc.

With CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION enabled, the

duplicate call to proto_register() triggers this BUG():

list_add double add: new=ffffffffc0b280d0, prev=ffffffffbab56250,

next=ffffffffc0b280d0.

------------[ cut here ]------------

kernel BUG at lib/list_debug.c:35!

Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI

CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1

RIP: 0010:__list_add_valid_or_report+0x9a/0xa0

...

__list_add_valid_or_report+0x9a/0xa0

proto_register+0x2b5/0x340

iso

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References