Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-41063

Bluetooth: hci_core: cancel all works upon hci_unregister_dev()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.19.319, 5.4.281, 5.10.223, 5.15.164, 6.1.101, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destroy_workqueue(), for hci_error_reset() is called from hdev->req_workqueue which destroy_workqueue() needs to flush. We need to make sure that hdev->{rx_work,cmd_work,tx_work} which are queued into hdev->workqueue and hdev->{power_on,error_reset} which are queued into hdev->req_workqueue are no longer running by the moment destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); are called from hci_release_dev(). Call cancel_work_sync() on these work items from hci_unregister_dev() as soon as hdev->list is removed from hci_dev_list.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 4.19.309 · fixed in 4.19.319; From 5.4.271 · fixed in 5.4.281; From 5.10.212 · fixed in 5.10.223; From 5.15.151 · fixed in 5.15.164; From 6.1.81 · fixed in 6.1.101; From 6.6.21 · fixed in 6.6.42; From 6.7.9 · fixed in 6.8

  • Linux Linux

    6.8

References 8

git.kernel.org