Memory Leak Vulnerability in Linux Kernel Bluetooth Module
Summary
DEBIAN-CVE-2024-26887: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix memory leak This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone the skb and also make sure btmtk_process_core... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The 'linux' package in Debian is crucial for system stability and performance, handling various functionalities including device management, process scheduling, and memory management. This vulnerability specifically affects the Bluetooth subsystem, which is responsible for wireless communication with Bluetooth devices.
Vulnerability Detail
In the Linux kernel, a memory leak was identified in the Bluetooth module, specifically within the btusb driver. The vulnerability arises when the system attempts to clone a socket buffer (skb) without checking if the CONFIG_DEV_COREDUMP configuration is enabled. If this check is not performed, it can lead to memory not being freed properly, resulting in increased memory usage and potential system instability. This issue has been classified under CVE-2024-26887 and affects Debian versions 13 and 14.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The memory leak vulnerability in the Linux kernel's Bluetooth module poses a risk to system stability in affected Debian versions. Users are encouraged to update their systems to the patched version 6.7.12-1 to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26887 is a vulnerability in the Linux kernel's Bluetooth module that can lead to a memory leak.
If exploited, this vulnerability can cause increased memory usage, potentially leading to system instability or crashes.
Yes, Debian versions 13 and 14 are affected by this vulnerability.
While there are no specific workarounds, it is recommended to monitor your system's memory usage and apply the update as soon as possible.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without requiring signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
