{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53237", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.026Z", "datePublished": "2024-12-27T13:50:23.150Z", "dateUpdated": "2026-08-05T11:44:47.756Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:47.756Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix use-after-free in device_for_each_child()\n\nSyzbot has reported the following KASAN splat:\n\nBUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0\nRead of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980\n\nCPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x100/0x190\n ? device_for_each_child+0x18f/0x1a0\n print_report+0x13a/0x4cb\n ? __virt_addr_valid+0x5e/0x590\n ? __phys_addr+0xc6/0x150\n ? device_for_each_child+0x18f/0x1a0\n kasan_report+0xda/0x110\n ? device_for_each_child+0x18f/0x1a0\n ? __pfx_dev_memalloc_noio+0x10/0x10\n device_for_each_child+0x18f/0x1a0\n ? __pfx_device_for_each_child+0x10/0x10\n pm_runtime_set_memalloc_noio+0xf2/0x180\n netdev_unregister_kobject+0x1ed/0x270\n unregister_netdevice_many_notify+0x123c/0x1d80\n ? __mutex_trylock_common+0xde/0x250\n ? __pfx_unregister_netdevice_many_notify+0x10/0x10\n ? trace_contention_end+0xe6/0x140\n ? __mutex_lock+0x4e7/0x8f0\n ? __pfx_lock_acquire.part.0+0x10/0x10\n ? rcu_is_watching+0x12/0xc0\n ? unregister_netdev+0x12/0x30\n unregister_netdevice_queue+0x30d/0x3f0\n ? __pfx_unregister_netdevice_queue+0x10/0x10\n ? __pfx_down_write+0x10/0x10\n unregister_netdev+0x1c/0x30\n bnep_session+0x1fb3/0x2ab0\n ? __pfx_bnep_session+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? __pfx_woken_wake_function+0x10/0x10\n ? __kthread_parkme+0x132/0x200\n ? __pfx_bnep_session+0x10/0x10\n ? kthread+0x13a/0x370\n ? __pfx_bnep_session+0x10/0x10\n kthread+0x2b7/0x370\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x48/0x80\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n\nAllocated by task 4974:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kmalloc_noprof+0x1d1/0x440\n hci_alloc_dev_priv+0x1d/0x2820\n __vhci_create_device+0xef/0x7d0\n vhci_write+0x2c7/0x480\n vfs_write+0x6a0/0xfc0\n ksys_write+0x12f/0x260\n do_syscall_64+0xc7/0x250\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 4979:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x4f/0x70\n kfree+0x141/0x490\n hci_release_dev+0x4d9/0x600\n bt_host_release+0x6a/0xb0\n device_release+0xa4/0x240\n kobject_put+0x1ec/0x5a0\n put_device+0x1f/0x30\n vhci_release+0x81/0xf0\n __fput+0x3f6/0xb30\n task_work_run+0x151/0x250\n do_exit+0xa79/0x2c30\n do_group_exit+0xd5/0x2a0\n get_signal+0x1fcd/0x2210\n arch_do_signal_or_restart+0x93/0x780\n syscall_exit_to_user_mode+0x140/0x290\n do_syscall_64+0xd4/0x250\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nIn 'hci_conn_del_sysfs()', 'device_unregister()' may be called when\nan underlying (kobject) reference counter is greater than 1. This\nmeans that reparenting (happened when the device is actually freed)\nis delayed and, during that delay, parent controller device (hciX)\nmay be deleted. Since the latter may create a dangling pointer to\nfreed parent, avoid that scenario by reparenting to NULL explicitly." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The UAF is reached through the Bluetooth stack: a BNEP session is established when an adjacent peer connects to PANU/NAP (set up automatically by the privileged BT daemon), and the faulting `unregister_netdev()` path in `bnep_session()` is entered when that remote peer drops the L2CAP/ACL link. Per kernel scoring guidance and repo precedent for BNEP/HIDP lifetime UAFs, Bluetooth reachability is Adjacent.\nAC:L - The attacker drives both halves of the lifetime race by repeatedly connecting and abruptly disconnecting, and connection teardown reliably reaches `hci_conn_del_sysfs()` with a non-rfcomm child still attached, leaving the dangling grandparent pointer every time. No condition depends on memory layout or state the attacker cannot influence.\nPR:N - The attacker is an unauthenticated adjacent Bluetooth device with no local account; the `capable(CAP_NET_ADMIN)` gate on `BNEPCONNADD` is satisfied by bluetoothd acting on the peer's behalf during normal PAN/HID service handling. This matches how the kernel CNA scored the comparable bnep/HIDP UAFs.\nUI:N - No victim action is needed — session teardown is triggered by the attacker's own disconnect, and controller unregistration occurs routinely via suspend/resume, USB dongle reset, firmware error recovery, or driver reload.\nS:U - The corrupted `hci_dev` object and the faulting code both live in the kernel's own security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - `device_for_each_child()` dereferences `dev->p` and walks `klist_children` inside the freed `hci_dev` slab, so an attacker who reclaims and sprays that large kmalloc allocation can steer the traversal to read arbitrary kernel memory.\nI:H - The traversal is not read-only — `klist_iter_init()` takes `spin_lock(&k->k_lock)` and `kref_get()` increments refcounts through pointers taken from the freed object, yielding attacker-influenced writes and a classic UAF heap-corruption primitive suitable for control-flow hijack.\nA:H - Confirmed by the syzbot KASAN slab-use-after-free report; dereferencing the freed `hci_dev` and walking a stale klist produces a kernel oops or lockup, remotely inducible by an adjacent peer." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hci_sysfs.c" ], "versions": [ { "version": "3c4236f1b2a715e878a06599fa8b0cc21f165d28", "lessThan": "6894717a1ea363c5a27010ba604f957c309d282d", "status": "affected", "versionType": "git" }, { "version": "53d61daf35b1bbf3ae06e852ee107aa2f05b3776", "lessThan": "fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5", "status": "affected", "versionType": "git" }, { "version": "ba7088769800d9892a7e4f35c3137a5b3e65410b", "lessThan": "a9584c897d1cba6265c78010bbb45ca5722c88bc", "status": "affected", "versionType": "git" }, { "version": "87624b1f9b781549e69f92db7ede012a21cec275", "lessThan": "0f67ca2a80acf8b207240405b7f72d660665d3df", "status": "affected", "versionType": "git" }, { "version": "56a4fdde95ed98d864611155f6728983e199e198", "lessThan": "de5a44f351ca7efd9add9851b218f5353e2224b7", "status": "affected", "versionType": "git" }, { "version": "a85fb91e3d728bdfc80833167e8162cce8bc7004", "lessThan": "91e2a2e4d1336333804cd31162984f01ad8cc70f", "status": "affected", "versionType": "git" }, { "version": "a85fb91e3d728bdfc80833167e8162cce8bc7004", "lessThan": "7b277bd569bb6a2777f0014f84b4344f444fd49d", "status": "affected", "versionType": "git" }, { "version": "a85fb91e3d728bdfc80833167e8162cce8bc7004", "lessThan": "27aabf27fd014ae037cc179c61b0bee7cff55b3d", "status": "affected", "versionType": "git" }, { "version": "5c53afc766e07098429520b7677eaa164b593451", "status": "affected", "versionType": "git" }, { "version": "fc666d1b47518a18519241cae213de1babd4a4ba", "status": "affected", "versionType": "git" }, { "version": "5.4.262", "lessThan": "5.4.297", "status": "affected", "versionType": "semver" }, { "version": "5.10.202", "lessThan": "5.10.231", "status": "affected", "versionType": "semver" }, { "version": "5.15.140", "lessThan": "5.15.174", "status": "affected", "versionType": "semver" }, { "version": "6.1.64", "lessThan": "6.1.120", "status": "affected", "versionType": "semver" }, { "version": "6.6.3", "lessThan": "6.6.64", "status": "affected", "versionType": "semver" }, { "version": "4.19.300", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "6.5.13", "lessThan": "6.6", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hci_sysfs.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.262", "versionEndExcluding": "5.4.297" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.202", "versionEndExcluding": "5.10.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.140", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.64", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.3", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.300" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6894717a1ea363c5a27010ba604f957c309d282d" }, { "url": "https://git.kernel.org/stable/c/fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5" }, { "url": "https://git.kernel.org/stable/c/a9584c897d1cba6265c78010bbb45ca5722c88bc" }, { "url": "https://git.kernel.org/stable/c/0f67ca2a80acf8b207240405b7f72d660665d3df" }, { "url": "https://git.kernel.org/stable/c/de5a44f351ca7efd9add9851b218f5353e2224b7" }, { "url": "https://git.kernel.org/stable/c/91e2a2e4d1336333804cd31162984f01ad8cc70f" }, { "url": "https://git.kernel.org/stable/c/7b277bd569bb6a2777f0014f84b4344f444fd49d" }, { "url": "https://git.kernel.org/stable/c/27aabf27fd014ae037cc179c61b0bee7cff55b3d" } ], "title": "Bluetooth: fix use-after-free in device_for_each_child()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53237", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-11T15:43:02.570092Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:45:25.655Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:48:05.216Z" } } ] } }