Out of Bounds Memory Access in Linux Kernel Bluetooth Driver
Summary
DEBIAN-CVE-2024-26890: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The Bluetooth subsystem within the kernel facilitates wireless communication between devices. This vulnerability affects the 'linux' package in Debian versions 13 and 14, specifically within the btrtl Bluetooth driver, which is responsible for Realtek Bluetooth devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the btrtl Bluetooth driver that allows for out-of-bounds memory access. This issue arises when the btrtl driver is used with the btusb module, where memory for private HCI data is allocated incorrectly. If the btrtl driver is used with the hci_h5 interface, no private data is allocated after the hci_dev structure, leading to potential memory corruption and system instability. The vulnerability is detected by KASAN (Kernel Address Sanitizer), which reports slab-out-of-bounds errors, indicating that the driver may write beyond allocated memory, potentially allowing for arbitrary code execution or system crashes.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Bluetooth functionality on their devices until the package is updated. This can be done by executing the command:
sudo systemctl stop bluetooth.service' to stop the Bluetooth service.
Conclusion
The identified vulnerability in the Linux kernel's btrtl Bluetooth driver poses significant risks, including potential system instability and security breaches. Users are advised to update their systems to the patched version to mitigate these risks. Temporary workarounds are available, but the best course of action is to apply the necessary updates as soon as possible.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to out-of-bounds memory access, which may result in system crashes or arbitrary code execution.
You can use the Vulert platform to check if your application is affected by this vulnerability without needing to install any software.
If an immediate update is not possible, consider disabling Bluetooth functionality as a temporary measure.
Yes, this vulnerability specifically affects Realtek Bluetooth devices using the btrtl driver.
Detailed information can be found in the Debian CVE database or by visiting the Vulert website for real-time vulnerability monitoring.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
