Critical Bluetooth Vulnerability in Linux Package: Slab Use-After-Free in l2cap_connect()
Summary
DEBIAN-CVE-2024-36013: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Affects linux versions < 6.8.11-1. Fixed in 6.8.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It includes support for various protocols, including Bluetooth, which allows devices to communicate wirelessly. The package is crucial for system stability and performance, but it is also susceptible to vulnerabilities that can compromise system security.
Vulnerability Detail
A critical vulnerability has been identified in the Linux kernel related to Bluetooth functionality. Specifically, it involves a slab-use-after-free error in the l2cap_connect() function. This vulnerability arises when a channel is prematurely freed, leading to potential exploitation by attackers. The issue can result in unauthorized access to system resources, data corruption, or even system crashes. The vulnerability is traced back to improper management of memory allocation and deallocation within the Bluetooth L2CAP layer, making it a significant concern for users relying on Bluetooth connectivity.
How To Fix
Minimum fixed version
6.8.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate risks associated with this issue.
Conclusion
The identified vulnerability in the Linux package poses a significant risk to systems utilizing Bluetooth functionality. Users are strongly encouraged to update to the patched version 6.8.11-1 to safeguard their systems. Utilizing tools like Vulert can aid in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a slab-use-after-free error in the Bluetooth L2CAP layer, which can lead to unauthorized access and system instability.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected. Visit Vulert Scanner to use the Vulert playground.
The vulnerability can lead to data corruption, unauthorized access to system resources, and potential system crashes.
Yes, the patched version of the Linux package is 6.8.11-1. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating your package as soon as possible to protect against potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
