CVE-2024-41063

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41063
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destroy_workqueue(), for hci_error_reset() is called from hdev->req_workqueue which destroy_workqueue() needs to flush. We need to make sure that hdev->{rx_work,cmd_work,tx_work} which are queued into hdev->workqueue and hdev->{power_on,error_reset} which are queued into hdev->req_workqueue are no longer running by the moment destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); are called from hci_release_dev(). Call cancel_work_sync() on these work items from hci_unregister_dev() as soon as hdev->list is removed from hci_dev_list.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0d151a103775dd9645c78c97f77d6e2a5298d913 Patch
https://git.kernel.org/stable/c/3f939bd73fed12dddc2a32a76116c19ca47c7678 Patch
https://git.kernel.org/stable/c/48542881997e17b49dc16b93fe910e0cfcf7a9f9 Patch
https://git.kernel.org/stable/c/96600c2e5ee8213dbab5df1617293d8e847bb4fa Patch
https://git.kernel.org/stable/c/9cfc84b1d464cc024286f42a090718f9067b80ed Patch
https://git.kernel.org/stable/c/d2ce562a5aff1dcd0c50d9808ea825ef90da909f Patch
https://git.kernel.org/stable/c/d6cbce18370641a21dd889e8613d8153df15eb39 Patch
https://git.kernel.org/stable/c/ddeda6ca5f218b668b560d90fc31ae469adbfd92 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*
History

10 Sep 2024, 17:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: hci_core: cancelar todos los trabajos en hci_unregister_dev() syzbot informa que llamar a hci_release_dev() desde hci_error_reset() debido a hci_dev_put() desde hci_error_reset() puede causar un punto muerto en destroy_workqueue( ), porque hci_error_reset() se llama desde hdev->req_workqueue y destroy_workqueue() necesita vaciarse. Necesitamos asegurarnos de que hdev->{rx_work,cmd_work,tx_work} que están en cola en hdev->workqueue y hdev->{power_on,error_reset} que están en cola en hdev->req_workqueue ya no se estén ejecutando en el momento destroy_workqueue( hdev->cola de trabajo); destroy_workqueue(hdev->req_workqueue); se llaman desde hci_release_dev(). Llame a cancel_work_sync() en estos elementos de trabajo desde hci_unregister_dev() tan pronto como se elimine hdev->list de hci_dev_list.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*
CWE CWE-667
References () https://git.kernel.org/stable/c/0d151a103775dd9645c78c97f77d6e2a5298d913 - () https://git.kernel.org/stable/c/0d151a103775dd9645c78c97f77d6e2a5298d913 - Patch
References () https://git.kernel.org/stable/c/3f939bd73fed12dddc2a32a76116c19ca47c7678 - () https://git.kernel.org/stable/c/3f939bd73fed12dddc2a32a76116c19ca47c7678 - Patch
References () https://git.kernel.org/stable/c/48542881997e17b49dc16b93fe910e0cfcf7a9f9 - () https://git.kernel.org/stable/c/48542881997e17b49dc16b93fe910e0cfcf7a9f9 - Patch
References () https://git.kernel.org/stable/c/96600c2e5ee8213dbab5df1617293d8e847bb4fa - () https://git.kernel.org/stable/c/96600c2e5ee8213dbab5df1617293d8e847bb4fa - Patch
References () https://git.kernel.org/stable/c/9cfc84b1d464cc024286f42a090718f9067b80ed - () https://git.kernel.org/stable/c/9cfc84b1d464cc024286f42a090718f9067b80ed - Patch
References () https://git.kernel.org/stable/c/d2ce562a5aff1dcd0c50d9808ea825ef90da909f - () https://git.kernel.org/stable/c/d2ce562a5aff1dcd0c50d9808ea825ef90da909f - Patch
References () https://git.kernel.org/stable/c/d6cbce18370641a21dd889e8613d8153df15eb39 - () https://git.kernel.org/stable/c/d6cbce18370641a21dd889e8613d8153df15eb39 - Patch
References () https://git.kernel.org/stable/c/ddeda6ca5f218b668b560d90fc31ae469adbfd92 - () https://git.kernel.org/stable/c/ddeda6ca5f218b668b560d90fc31ae469adbfd92 - Patch
First Time Linux linux Kernel
Linux

29 Jul 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-29 15:15

Updated : 2024-09-10 17:10

NVD link : CVE-2024-41063

Mitre link : CVE-2024-41063

CVE.ORG link : CVE-2024-41063

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking