linux-cve-announce - CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122704-CVE-2024-56604-8494@gregkh>
Date: Fri, 27 Dec 2024 15:51:11 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()

bt_sock_alloc() attaches allocated sk object to the provided sock object.
If rfcomm_dlc_alloc() fails, we release the sk object, but leave the
dangling pointer in the sock object, which may cause use-after-free.

Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().

The Linux kernel CVE team has assigned CVE-2024-56604 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.120 with commit ac3eaac4cf142a15fe67be747a682b1416efeb6e
	Fixed in 6.6.66 with commit 6021ccc2471b7b95e29b7cfc7938e042bf56e281
	Fixed in 6.12.5 with commit 32df687e129ef0f9afcbcc914f7c32deb28fd481
	Fixed in 6.13-rc1 with commit 3945c799f12b8d1f49a3b48369ca494d981ac465

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56604
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/rfcomm/sock.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ac3eaac4cf142a15fe67be747a682b1416efeb6e
	https://git.kernel.org/stable/c/6021ccc2471b7b95e29b7cfc7938e042bf56e281
	https://git.kernel.org/stable/c/32df687e129ef0f9afcbcc914f7c32deb28fd481
	https://git.kernel.org/stable/c/3945c799f12b8d1f49a3b48369ca494d981ac465