Executive brief
A vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) component could allow a local user to crash the system. The issue occurs when the system fails to properly track the initialization status of Bluetooth networking, leading to an invalid memory access when the module is removed. This primarily impacts system availability, potentially causing a kernel panic or "Blue Screen" equivalent on Linux devices.
Technical details
A wild-memory-access vulnerability exists in the Linux kernel's Bluetooth BNEP implementation within the proto_unregister function. The root cause is that bnep_init() ignores the return value of bnep_sock_init(); if bnep_sock_init() fails, it performs its own cleanup, but the module remains loaded. Subsequent attempts to unload the module via rmmod trigger bnep_sock_cleanup(), leading to an invalid memory access (detected by KASAN) because the resources were already freed or never properly initialized. This is a local attack requiring the ability to load/unload kernel modules or trigger module cleanup. Patches have been released across multiple stable kernel branches to ensure bnep_init() correctly propagates the initialization status.
Affected products
- Linux Linux Kernel 2.6.12 to 4.19.322, 4.20 to 5.4.284, 5.5 to 5.10.228, 5.11 to 5.15.169, 5.16 to 6.1.114, 6.2 to 6.6.58, 6.7 to 6.11.5
Timeline
- 2024-11-07: disclosed
- 2024-11-07: advisory
- 2024-10-16: patched: Initial fix in mainline kernel
References
- https://git.kernel.org/stable/c/03015b6329e6de42f03ec917c25c4cf944f81f66
- https://git.kernel.org/stable/c/20c424bc475b2b2a6e0e2225d2aae095c2ab2f41
- https://git.kernel.org/stable/c/2c439470b23d78095a0d2f923342df58b155f669
- https://git.kernel.org/stable/c/64a90991ba8d4e32e3173ddd83d0b24167a5668c
- https://git.kernel.org/stable/c/6c151aeb6dc414db8f4daf51be072e802fae6667
- https://git.kernel.org/stable/c/d10cd7bf574ead01fae140ce117a11bcdacbe6a8
- https://git.kernel.org/stable/c/e232728242c4e98fb30e4c6bedb6ba8b482b6301