PT-2024-33910 · Linux+7 · Linux Kernel+7
Aaron Thompson
·
Published
2024-10-28
·
Updated
2025-10-03
·
CVE-2024-50078
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.10.11-4+bt2-ao-desktop
Description:
The issue arises when the
iso init() function is called without a corresponding call to iso exit() on module unload. This causes the struct proto registered with proto register() to become invalid, potentially leading to unpredictable problems. In cases where CONFIG LIST HARDENED and CONFIG BUG ON DATA CORRUPTION are enabled, reloading the module may trigger a bug due to list add corruption.Recommendations:
For Linux kernel versions prior to 6.10.11-4+bt2-ao-desktop, ensure that
iso exit() is called on module unload if iso init() has been called. As a temporary workaround, consider disabling the bt init() function until a patch is available. Restrict access to the hci sock init() function to minimize the risk of exploitation. Avoid using the proto register() function in the affected Bluetooth module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu