CVE-2024-42141
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
30/07/2024
Last modified:
11/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
Bluetooth: ISO: Check socket flag instead of hcon<br />
<br />
This fixes the following Smatch static checker warning:<br />
<br />
net/bluetooth/iso.c:1364 iso_sock_recvmsg()<br />
error: we previously assumed &#39;pi->conn->hcon&#39; could be null (line 1359)<br />
<br />
net/bluetooth/iso.c<br />
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,<br />
1348 size_t len, int flags)<br />
1349 {<br />
1350 struct sock *sk = sock->sk;<br />
1351 struct iso_pinfo *pi = iso_pi(sk);<br />
1352<br />
1353 BT_DBG("sk %p", sk);<br />
1354<br />
1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,<br />
&bt_sk(sk)->flags)) {<br />
1356 lock_sock(sk);<br />
1357 switch (sk->sk_state) {<br />
1358 case BT_CONNECT2:<br />
1359 if (pi->conn->hcon &&<br />
^^^^^^^^^^^^^^ If ->hcon is NULL<br />
<br />
1360 test_bit(HCI_CONN_PA_SYNC,<br />
&pi->conn->hcon->flags)) {<br />
1361 iso_conn_big_sync(sk);<br />
1362 sk->sk_state = BT_LISTEN;<br />
1363 } else {<br />
--> 1364 iso_conn_defer_accept(pi->conn->hcon);<br />
^^^^^^^^^^^^^^<br />
then we&#39;re toast<br />
<br />
1365 sk->sk_state = BT_CONFIG;<br />
1366 }<br />
1367 release_sock(sk);<br />
1368 return 0;<br />
1369 case BT_CONNECTED:<br />
1370 if (test_bit(BT_SK_PA_SYNC,
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.5.12 (including) | 6.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6 (including) | 6.6.39 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.9.9 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/045669710464a21c67e690ef14698fd71857cb11
- https://git.kernel.org/stable/c/33fabef489169c6db87843ef23351ed0d5e51ad8
- https://git.kernel.org/stable/c/596b6f081336e77764ca35cfeab66d0fcdbe544e
- https://git.kernel.org/stable/c/045669710464a21c67e690ef14698fd71857cb11
- https://git.kernel.org/stable/c/33fabef489169c6db87843ef23351ed0d5e51ad8
- https://git.kernel.org/stable/c/596b6f081336e77764ca35cfeab66d0fcdbe544e



