CVE-2024-36013: linux-libc-dev - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
Summary
CVE-2024-36013: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build applications that interact with the Linux kernel. This package is vulnerable to a slab-use-after-free vulnerability in the Bluetooth L2CAP module.
Vulnerability Detail
The vulnerability in linux-libc-dev allows an attacker to exploit a slab-use-after-free issue in the L2CAP (Logical Link Control and Adaptation Protocol) module of the Bluetooth subsystem. By manipulating certain Bluetooth packets, an attacker can trigger a use-after-free condition, leading to potential memory corruption and possible arbitrary code execution. This vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the linux-libc-dev package to the latest version.
Conclusion
The linux-libc-dev package is vulnerable to a slab-use-after-free vulnerability in the Bluetooth L2CAP module. It is crucial to update the package to version 6.1.90-1 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for development. It is used to compile and build applications that interact with the Linux kernel.
L2CAP (Logical Link Control and Adaptation Protocol) is a protocol used in Bluetooth communication to establish and manage logical links between devices.
A slab-use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to memory corruption and potential exploitation by an attacker.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
To update the linux-libc-dev package, you can use your package manager or follow the instructions provided by your Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
