Junglewise Threat Intelligence

CVE-2024-58009: Linux Kernel NULL pointer dereference in Bluetooth L2CAP

CVE-2024-58009 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash. The issue occurs when the system handles certain Bluetooth connection requests, potentially allowing a local user to trigger a denial-of-service state. This affects the reliability and availability of systems using Bluetooth L2CAP connections.

Technical details

A NULL pointer dereference vulnerability exists in the Linux kernel Bluetooth L2CAP implementation. The issue resides in the l2cap_sock_alloc() function, which can be passed a NULL socket pointer when called from l2cap_sock_new_connection_cb(). If l2cap_chan_create() fails during this process, the error handling path attempts to dereference the NULL socket pointer to clear its internal state. A local attacker could potentially exploit this to cause a kernel panic (Denial of Service). The fix introduces a NULL check before the pointer dereference in the error path. Patches have been released for multiple stable kernel branches including 5.4, 5.10, 5.15, 6.1, 6.6, 6.12, and 6.13.

Affected products

  • Linux Linux Kernel 5.4.287 to 5.4.291; 5.10.231 to 5.10.235; 5.15.174 to 5.15.179; 6.1.120 to 6.1.129; 6.6.66 to 6.6.78; 6.12.5 to 6.12.14; 6.13 to 6.13.3

Timeline

  • 2024-12-18: other: Patch authored
  • 2025-01-15: patched: Mainline patch committed
  • 2025-02-27: disclosed: CVE published

References

Related threats