{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-36012", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.153Z", "datePublished": "2024-05-23T07:03:06.904Z", "dateUpdated": "2026-08-05T11:31:34.945Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:34.945Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: msft: fix slab-use-after-free in msft_do_close()\n\nTying the msft->data lifetime to hdev by freeing it in\nhci_release_dev() to fix the following case:\n\n[use]\nmsft_do_close()\n msft = hdev->msft_data;\n if (!msft) ...(1) <- passed.\n return;\n mutex_lock(&msft->filter_lock); ...(4) <- used after freed.\n\n[free]\nmsft_unregister()\n msft = hdev->msft_data;\n hdev->msft_data = NULL; ...(2)\n kfree(msft); ...(3) <- msft is freed.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in __mutex_lock_common\nkernel/locking/mutex.c:587 [inline]\nBUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30\nkernel/locking/mutex.c:752\nRead of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Triggering requires local operations on the HCI transport and adapter power state (device create/teardown plus a concurrent close), not any over-the-air Bluetooth frame or network packet. The vulnerable `msft_do_close()` path is only reachable through local device-lifecycle operations.\nAC:L - The attacker controls both sides of the race — it creates the HCI device, arms the close path (the 2-second `power_off` auto-off delayed work, or an injected HCI Hardware Error that queues `error_reset`), then tears the transport down to run `msft_unregister()` concurrently. The window is wide (no shared lock between the free and the use) and the attempt is infinitely retryable.\nPR:L - An unprivileged local user reaching the Bluetooth HCI device-management interfaces can drive both the adapter power-down path and the transport teardown that frees `msft_data`; no real root in the initial namespace is required to win this race. This matches the privilege level assigned to the equivalent HCI teardown use-after-frees (CVE-2024-53208, CVE-2024-58013, CVE-2024-58241).\nUI:N - The race is driven entirely by the attacker's own sequence of device-lifecycle and power-state operations. No victim action or interaction is needed at any point.\nS:U - The freed object, the corrupted heap, and the resulting compromise all reside within the kernel's own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - After the freed `msft_data` slab is reallocated with sprayed data, `msft_do_close()` walks `msft->handle_map` and reads `handle_data->mgmt_handle` from attacker-controlled memory and feeds it to `idr_find()`, yielding an arbitrary kernel read primitive. Any use-after-free of this shape enables disclosure of arbitrary kernel memory.\nI:H - The same list walks perform `list_del()` on attacker-controlled `list_head` pointers — an arbitrary write of pointer values to attacker-chosen kernel addresses — followed by `kfree()` of an attacker-chosen pointer, and `mutex_lock()` on a corrupted `filter_lock`. These are classic primitives for control-flow hijacking and local privilege escalation.\nA:H - Even without successful exploitation, the slab-use-after-free reliably corrupts kernel state and causes an oops or panic, as demonstrated by the KASAN report in `__mutex_lock` from `kworker/u5:2`. This is a complete denial of service that the attacker can trigger at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hci_core.c", "net/bluetooth/msft.c", "net/bluetooth/msft.h" ], "versions": [ { "version": "bf6a4e30ffbd9e9ef8934582feb937f6532f8b68", "lessThan": "e3880b531b68f98d3941d83f2f6dd11cf4fd6b76", "status": "affected", "versionType": "git" }, { "version": "bf6a4e30ffbd9e9ef8934582feb937f6532f8b68", "lessThan": "a85a60e62355e3bf4802dead7938966824b23940", "status": "affected", "versionType": "git" }, { "version": "bf6a4e30ffbd9e9ef8934582feb937f6532f8b68", "lessThan": "4f1de02de07748da80a8178879bc7a1df37fdf56", "status": "affected", "versionType": "git" }, { "version": "bf6a4e30ffbd9e9ef8934582feb937f6532f8b68", "lessThan": "10f9f426ac6e752c8d87bf4346930ba347aaabac", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hci_core.c", "net/bluetooth/msft.c", "net/bluetooth/msft.h" ], "versions": [ { "version": "5.12", "status": "affected" }, { "version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.91", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.91" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.8.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76" }, { "url": "https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940" }, { "url": "https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56" }, { "url": "https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac" } ], "title": "Bluetooth: msft: fix slab-use-after-free in msft_do_close()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-10T18:54:16.912662Z", "id": "CVE-2024-36012", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T18:54:24.668Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.508Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac", "tags": [ "x_transferred" ] } ] } ] } }