CVE-2024-50255

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs

Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes.

__hci_cmd_sync_sk() returns NULL if a command returns a status event.

However, it also returns NULL where an opcode doesn't exist in the

hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0]

for unknown opcodes.

This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as

there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes

status = skb->data[0].

KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]

CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014

Workqueue: hci7 hci_power_on

RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138

Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References