Executive brief
A race condition vulnerability exists in the Bluetooth subsystem of the Linux kernel. This flaw can cause Bluetooth connections or broadcasts to behave abnormally, potentially allowing an attacker in physical proximity to cause a system crash or service outage. This affects various Linux distributions and industrial hardware using Linux-based subsystems, such as certain Siemens SIMATIC controllers.
Technical details
A race condition was identified in the net/bluetooth component of the Linux kernel, specifically within the {conn,adv}_{min,max}_interval_set() functions. The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). An attacker within Bluetooth range (Adjacent) can exploit this timing flaw during the setting of connection or advertising intervals. Successful exploitation can result in I2CAP connection failures or broadcast abnormalities, leading to a Denial of Service (DoS) condition. Patches have been released for various kernel branches, including updates for Debian LTS (versions 4.19.316-1 and 5.10.216-1~deb10u1).
Affected products
- Linux Linux Kernel 3.19.8, 6.0 to 6.6.25, 6.7 to 6.7.12, 6.8-rc1
- Debian Debian Linux 10.0
- Siemens SIMATIC S7-1500 TM MFP All versions affected by GNU/Linux subsystem vulnerabilities
Timeline
- 2024-02-05: disclosed: Initial disclosure by OpenAnolis
- 2024-02-05: advisory: NVD entry published
- 2024-04-09: advisory: Siemens published advisory SSA-265688
- 2024-06-25: patched: Debian released security updates for linux-5.10 and linux-4.19