CVE-2024-50148

CVE-2024-50148

Medium · published November 7, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: fix wild-memory-access in proto_unregister

There's issue as follows:

KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f]

CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G W

RIP: 0010:proto_unregister+0xee/0x400

Call Trace:

<TASK>

__do_sys_delete_module+0x318/0x580

do_syscall_64+0xc1/0x1d0

entry_SYSCALL_64_after_hwframe+0x77/0x7f

As bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init()

will cleanup all resource. Then when remove bnep module will call

bnep_sock_cleanup() to cleanup sock's resource.

To solve above issue just return bnep_sock_init()'s return value in

bnep_exit().

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Published
2024-11-07T15:15Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.12, < 4.19.3234.19.323
linux/linux_kernel≥ 4.20, < 5.4.2855.4.285
linux/linux_kernel≥ 5.5, < 5.10.2295.10.229
linux/linux_kernel≥ 5.11, < 5.15.1705.15.170
linux/linux_kernel≥ 5.16, < 6.1.1156.1.115
linux/linux_kernel≥ 6.2, < 6.6.596.6.59
linux/linux_kernel≥ 6.7, < 6.11.66.11.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (11)
EPSS history
Timeline
  • 07 NOV 09:31Z
    Bluetooth: bnep: fix wild-memory-access in proto_unregister
    cvelistv5