Junglewise Threat Intelligence

CVE-2024-26903: Linux Kernel null pointer dereference in Bluetooth RFCOMM

CVE-2024-26903 · Severity: medium · CVSS 5.5 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Bluetooth component could allow a local attacker to crash the system. The issue occurs during the specific timing of Bluetooth device connection and disconnection, leading to a system failure (kernel panic). This affects the availability of the system but does not directly expose user data.

Technical details

A null pointer dereference exists in the rfcomm_check_security function within the Linux kernel's Bluetooth subsystem. The vulnerability is triggered when a controller's response to a 'Read Encryption Key Size' (HCI_CMD 0x1408) is delayed until after the RFCOMM and L2CAP layers have disconnected but before the HCI layer has disconnected. In this state, the l2cap_conn structure is released, but rfcomm_check_security still attempts to access it via conn->hcon, causing the crash. The fix introduces a check for the BT_CLOSED state in rfcomm_process_rx before calling rfcomm_recv_frame.

Affected products

  • Linux Linux Kernel up to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-04-17: advisory: CVE-2024-26903 published
  • 2024-02-28: patched: Fix committed to mainline kernel

References

Related threats