Junglewise Threat Intelligence

CVE-2024-26889: Linux Kernel buffer overflow in Bluetooth hci_core

CVE-2024-26889 · Severity: medium · CVSS 5.5 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local user to cause a system crash. The issue occurs when the system processes Bluetooth device information, specifically when a device name exceeds a small fixed buffer size. This could lead to a denial-of-service condition, impacting the availability of the affected system.

Technical details

A classic buffer overflow (CWE-120) exists in net/bluetooth/hci_core.c within the hci_get_dev_info function. The vulnerability is caused by the use of strcpy() to copy a device name into the fixed-size name[8] field of the hci_dev_info structure without length validation. If hdev->name exceeds 8 characters, the copy operation writes past the end of the destination buffer. A local attacker with low privileges can exploit this to trigger a kernel crash (denial of service). The issue has been resolved by replacing strcpy() with strscpy() to ensure bounds checking.

Affected products

  • Linux Linux Kernel 4.14.328 to 4.15, 4.19.297 to 4.19.311, 5.4.259 to 5.4.273, 5.10.199 to 5.10.214, 5.15.137 to 5.15.153, 6.1.60 to 6.1.83, 6.5.9 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-04-17: advisory: Initial publication of CVE-2024-26889
  • 2024-03-26: patched: Fixes committed to various stable kernel branches

References

Related threats