CVE - CVE-2024-26801

CVE-ID
CVE-2024-26801	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset. Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30 This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/2449007d3f73b2842c9734f45f0aadb522daf592 URL:https://git.kernel.org/stable/c/2449007d3f73b2842c9734f45f0aadb522daf592 MISC:https://git.kernel.org/stable/c/2ab9a19d896f5a0dd386e1f001c5309bc35f433b URL:https://git.kernel.org/stable/c/2ab9a19d896f5a0dd386e1f001c5309bc35f433b MISC:https://git.kernel.org/stable/c/45085686b9559bfbe3a4f41d3d695a520668f5e1 URL:https://git.kernel.org/stable/c/45085686b9559bfbe3a4f41d3d695a520668f5e1 MISC:https://git.kernel.org/stable/c/6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2 URL:https://git.kernel.org/stable/c/6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2 MISC:https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090 URL:https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090 MISC:https://git.kernel.org/stable/c/da4569d450b193e39e87119fd316c0291b585d14 URL:https://git.kernel.org/stable/c/da4569d450b193e39e87119fd316c0291b585d14 MISC:https://git.kernel.org/stable/c/dd594cdc24f2e48dab441732e6dfcafd6b0711d1 URL:https://git.kernel.org/stable/c/dd594cdc24f2e48dab441732e6dfcafd6b0711d1 MISC:https://git.kernel.org/stable/c/e0b278650f07acf2e0932149183458468a731c03 URL:https://git.kernel.org/stable/c/e0b278650f07acf2e0932149183458468a731c03
Assigning CNA
kernel.org
Date Record Created
20240219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)