Junglewise Threat Intelligence

CVE-2024-22099: Linux kernel NULL pointer dereference in Bluetooth RFCOMM

CVE-2024-22099 · Severity: medium · CVSS 6.3 · Published 2024-01-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Bluetooth implementation that can cause a system crash. The issue occurs when the system attempts to check security settings for a Bluetooth connection that has already been partially disconnected. An attacker could exploit this to cause a denial-of-service (system crash), impacting the availability of devices using Bluetooth RFCOMM modules.

Technical details

A NULL pointer dereference exists in the rfcomm_check_security function within net/bluetooth/rfcomm/core.c. The vulnerability is triggered by a race condition or timing issue where a Bluetooth controller's response to an encryption key size request is delayed until after the RFCOMM and L2CAP layers have disconnected but before the HCI layer has finished. When the host processes this delayed response, it attempts to access a connection structure (l2cap_conn) that has already been released, leading to the dereference of a NULL pointer. This issue was identified via fuzzing and affects various kernel versions including 5.10 and 6.7-rc2. A fix has been committed to the upstream Bluetooth-next repository.

Affected products

  • Linux Linux kernel v2.6.12-rc2 and later versions including 5.10 and 6.7-rc2

Timeline

  • 2024-01-19: disclosed: Bug reported to OpenAnolis and upstream Linux kernel bugzilla
  • 2024-01-25: advisory: Initial CVE publication
  • 2024-03-12: patched: Fix identified in upstream bluetooth-next repository
  • 2024-06-25: patched: Debian LTS released security updates for kernel 5.10 and 4.19

References

Related threats