Bluetooth NULL Pointer Dereference Vulnerability in Linux Package
Summary
DEBIAN-CVE-2024-57987: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() If insert an USB dongle which chip is not maintained in ic_id_table, it will hit the NULL poin... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is highly modular, allowing for various functionalities, including support for Bluetooth devices. However, vulnerabilities in the kernel can lead to severe security issues, affecting system stability and data integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Bluetooth subsystem, specifically in the btrtl_setup_realtek() function. This issue arises when a USB dongle with an unsupported chip is inserted, leading to a NULL pointer access. The lack of a proper check for NULL values can result in a Kernel Oops, causing system crashes and potential data loss. This vulnerability can be exploited by attackers to destabilize the system or execute arbitrary code.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using unsupported USB dongles with the Linux system until the package is updated. Additionally, users can implement checks in their applications to verify the compatibility of Bluetooth devices before attempting to connect.
Conclusion
The Bluetooth NULL pointer dereference vulnerability in the Linux kernel poses significant risks to system stability and security. Users are advised to update their Linux packages to the latest patched version to mitigate these risks. Additionally, employing Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability, potentially allowing attackers to execute arbitrary code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux package is 6.12.13-1. Updating to this version will resolve the vulnerability.
As a temporary measure, avoid using unsupported USB dongles and implement compatibility checks in your applications.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57987.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
