CVE-2024-27398

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_...

Affected product and versions

Product

Linux Linux, fedora, linux kernel

Affected versions

>= 48669c81a65628ef234cbdd91b9395952c7c27fe < 1b33d55fb7355e27f8c82cd4ecd560f162469249, >= 37d7ae2b0578f2373674a755402ee722e96edc08 < 3212afd00e3cda790fd0583cb3eaef8f9575a014, >= a1073aad497d0d071a71f61b721966a176d50c08 < 33a6e92161a78c1073d90e27abe28d746feb0a53, >= ba316be1b6a00db7126ed9a39f9bee434a508043 < 6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5, >= ba316be1b6a00db7126ed9a39f9bee434a508043 < bfab2c1f7940a232cd519e82fff137e308abfd93, >= ba316be1b6a00db7126ed9a39f9bee434a508043 < 012363cb1bec5f33a7b94629ab2c1086f30280f2, >= ba316be1b6a00db7126ed9a39f9bee434a508043 < 50c2037fc28df870ef29d9728c770c8955d32178, >= ba316be1b6a00db7126ed9a39f9bee434a508043 < 483bc08181827fc475643272ffb69c533007e546, >= fea63ccd928c01573306983346588b26cffb5572, >= ec1f74319bb35c1c90c25014ec0f6ea6c3ca2134, >= b657bba82ff6a007d84fd076bd73b11131726a2b, >= 4.19.207 < 4.19.314, >= 5.4.148 < 5.4.276, >= 5.10.67 < 5.10.217, >= 4.14.263 < 4.15, >= 5.13.19 < 5.14, >= 5.14.6 < 5.15, >= 5.15, 39, 40

Fixed versions

4.15, 4.19.314, 5.4.276, 5.10.217, 5.14, 5.15.159, 6.1.91, 6.6.31, 6.8.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416