CVE-2024-26886: linux-libc-dev - Bluetooth: af_bluetooth: Fix deadlock
Summary
CVE-2024-26886: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this use... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library for Linux kernel system calls. It is an essential component for compiling and running programs on Debian-based systems. The package is responsible for providing the necessary interfaces and functions for user-space applications to interact with the kernel. The vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability, identified as CVE-2024-26886, is related to the Bluetooth functionality in the Linux kernel. It specifically affects the af_bluetooth module. The vulnerability could lead to a deadlock situation when attempting to perform a sock_lock on .recvmsg. This deadlock can cause a task to be blocked for more than 30 seconds, resulting in a denial-of-service condition. The issue arises due to the improper use of sock_sock, which can lead to a use-after-free vulnerability. An attacker could potentially exploit this vulnerability to disrupt Bluetooth communication and cause a system to become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the linux-libc-dev package, identified as CVE-2024-26886, affects the Bluetooth functionality in the Linux kernel. It can lead to a deadlock situation and cause a denial-of-service condition. To mitigate the risk, it is crucial to update the linux-libc-dev package to a version that includes the fix and regularly apply security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library for Linux kernel system calls. It is an essential component for compiling and running programs on Debian-based systems.
The vulnerability can lead to a deadlock situation and cause a denial-of-service condition. It can disrupt Bluetooth communication and make the system unresponsive.
To fix the vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the fix. Regularly updating the system with the latest security patches is also advised.
No specific workaround has been mentioned for this vulnerability.
More information about this vulnerability can be found on the Debian Security Tracker and the National Vulnerability Database (NVD) websites.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
