Race Condition in Linux Kernel Bluetooth L2CAP Socket Handling
Summary
CVE-2024-41062: In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases t... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system resource allocation. The Bluetooth subsystem within the Linux kernel facilitates wireless communication between devices. The vulnerability in question affects the L2CAP (Logical Link Control and Adaptation Protocol) layer, which is responsible for managing data packets in Bluetooth communication. This vulnerability can lead to improper handling of socket closures, potentially allowing unauthorized access to released resources.
Vulnerability Detail
In the Linux kernel, a race condition exists between the system call to close a Bluetooth socket and the handling of received data in the hci_rx_work function. Specifically, if the hci_rx_work function processes incoming data after the socket has been closed, it may access a released socket without proper lock protection. This can lead to undefined behavior, including potential crashes or exploitation by malicious actors. The vulnerability arises from the lack of synchronization between the socket release and the reception callback, allowing for the possibility of accessing invalid memory.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using Bluetooth functionalities until the kernel is updated. This can be done by disabling Bluetooth services using the following command:
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
Conclusion
CVE-2024-41062 represents a significant vulnerability within the Linux kernel's Bluetooth subsystem, specifically affecting the L2CAP layer. The race condition between socket closure and data reception poses risks that can be mitigated through timely updates and proper system management. Users are encouraged to stay informed about updates and utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for linux →
FAQ
CVE-2024-41062 is a vulnerability in the Linux kernel's Bluetooth subsystem that allows for a race condition between socket closure and data reception, potentially leading to unauthorized access to released resources.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13, with specific fixed versions available for Debian 12 and 13.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check if your application is affected by CVE-2024-41062 without any installation.
If an immediate update is not possible, consider disabling Bluetooth services as a temporary workaround to mitigate the risk associated with this vulnerability.
Detailed information about CVE-2024-41062 can be found in the official CVE database and through Linux kernel security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
