CVE-2024-58009

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58009
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22 Patch
https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785 Patch
https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1 Patch
https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 Patch
https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e Patch
https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd Patch
https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6 Patch
https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

22 Oct 2025, 19:39

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22 - () https://git.kernel.org/stable/c/245d48c1ba3e7a1779c2f4cbc6f581ddc8a78e22 - Patch
References () https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785 - () https://git.kernel.org/stable/c/297ce7f544aa675b0d136d788cad0710cdfb0785 - Patch
References () https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1 - () https://git.kernel.org/stable/c/49c0d55d59662430f1829ae85b969619573d0fa1 - Patch
References () https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 - () https://git.kernel.org/stable/c/5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 - Patch
References () https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e - () https://git.kernel.org/stable/c/691218a50c3139f7f57ffa79fb89d932eda9571e - Patch
References () https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd - () https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd - Patch
References () https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6 - () https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6 - Patch
References () https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0 - () https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-476

13 Mar 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/8e605f580a97530e5a3583beea458a3fa4cbefbd -
  • () https://git.kernel.org/stable/c/a9a7672fc1a0fe18502493936ccb06413ab89ea6 -
  • () https://git.kernel.org/stable/c/cf601a24120c674cd7c907ea695f92617af6abd0 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: L2CAP: gestionar puntero sock NULL en l2cap_sock_alloc Se pasa un puntero sock NULL a l2cap_sock_alloc() cuando se llama desde l2cap_sock_new_connection_cb() y las rutas de gestión de errores también deberían tenerlo en cuenta. Aparentemente, una solución más elegante sería intercambiar las llamadas bt_sock_alloc() y l2cap_chan_create() ya que no son interdependientes en ese momento, pero luego l2cap_chan_create() agrega el canal que pronto se desasignará y aún tiene inicialización ficticia a la lista global accesible por muchas rutas L2CAP. El canal se eliminaría de la lista en un corto período de tiempo, pero aquí sería un poco más directo y solo verificaría si es NULL en lugar de cambiar el orden de las llamadas de función. Encontrado por Linux Verification Center (linuxtesting.org) con la herramienta de análisis estático SVACE.

27 Feb 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 03:15

Updated : 2025-10-22 19:39

NVD link : CVE-2024-58009

Mitre link : CVE-2024-58009

CVE.ORG link : CVE-2024-58009

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference