Junglewise Threat Intelligence

CVE-2024-35933: Linux Kernel NULL pointer dereference in btintel_read_version

CVE-2024-35933 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Bluetooth driver for Intel devices. This flaw could allow a local user to cause a system crash (denial of service) by triggering a specific error condition during the initialization of Bluetooth hardware. This affects the stability of the operating system but does not directly expose user data.

Technical details

A NULL pointer dereference vulnerability exists in the btintel_read_version function within the Linux kernel's Bluetooth subsystem (drivers/bluetooth/btintel.c). The issue occurs when __hci_cmd_sync() returns NULL instead of a valid socket buffer (skb) or an error pointer. If hci_cmd_sync_complete() is triggered and the skb is NULL, hdev->req_skb becomes NULL, leading to a dereference when the code expects a valid pointer. An attacker with local access could potentially exploit this to cause a kernel panic (Denial of Service). The fix involves updating the error check to use IS_ERR_OR_NULL(skb) to properly handle cases where the command synchronization fails without returning an explicit error code.

Affected products

  • Linux Linux Kernel up to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.155, 5.16 to 6.1.86, 6.2 to 6.6.27, 6.7 to 6.8.6

Timeline

  • 2024-01-18: other: Patch authored
  • 2024-03-06: other: Patch committed to mainline
  • 2024-05-19: disclosed: CVE published

References

Related threats