PT-2024-4093 · Linux+5 · Linux Kernel+5

Sungwoo Kim · Published 2024-05-03 · Updated 2026-05-26 · CVE-2024-36013

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a slab-use-after-free vulnerability in the l2cap connect() function. This vulnerability can be exploited due to a race condition, allowing an attacker to potentially impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when the chan variable is freed early, and then its memory is accessed again, leading to a use-after-free condition. The l2cap connect() function is used in the Bluetooth L2CAP protocol implementation.

Technical details about exploitation include:

• The l2cap bredr sig cmd function calls l2cap connect(), which allocates memory for the chan variable.
• The l2cap conn del function frees the chan variable, but due to the race condition, the memory can be accessed after it has been freed.
• The vulnerability can be triggered by exploiting the race condition between the allocation and deallocation of the chan variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

BDU:2024-04544

CVE-2024-36013

ECHO-4AA9-31C2-0C40

INFSA-2025_6966

OESA-2025-1078

OPENSUSE-SU-2024_3190-1

OPENSUSE-SU-2024_3209-1

OPENSUSE-SU-2024_3483-1

RHSA-2025:6966

RHSA-2025_6966

SUSE-SU-2024:2135-1

SUSE-SU-2024:2203-1

SUSE-SU-2024:2973-1

SUSE-SU-2024:3189-1

SUSE-SU-2024:3190-1

SUSE-SU-2024:3209-1

SUSE-SU-2024:3251-1

SUSE-SU-2024:3252-1

SUSE-SU-2024:3483-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Debian

Linuxmint

Linux Kernel

Red Hat

Suse

Ubuntu

References · 3006

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36013.json · Exploit
• https://ubuntu.com/security/CVE-2024-38541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56562 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42095 · Security Note
• https://ubuntu.com/security/CVE-2024-36943 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38598 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41065 · Security Note
• https://ubuntu.com/security/CVE-2024-36962 · Vendor Advisory
• https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 · Patch
• https://ubuntu.com/security/notices/USN-6955-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56572 · Security Note
• https://ubuntu.com/security/CVE-2024-36952 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2024-36013 · Vendor Advisory