CVE-2024-56654 Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
A race condition in the Linux kernel Bluetooth subsystem can lead to system instability or denial of service due to improper RCU locking during list iteration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56654?
CVE-2024-56654 is a high-severity vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is not safe since for the most part entries fetched this way shall be treated as rcu_dereference:
Note that the value returned by rcu_dereference() is valid only within the enclosing RCU read-side critical section [1]_. For example, the following is **not** legal::
rcu_read_lock(); p = rcu_dereference(head.next); rcu_read_unlock(); x = p->address; /* BUG!!! */ rcu_read_lock(); y = p->data; /* BUG!!! */ rcu_read_unlock();
Which versions are affected by CVE-2024-56654?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56654?
Apply the vendor's patch.
Is CVE-2024-56654 being exploited?
There is no known exploitation of CVE-2024-56654 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-54910, BELL-CVE-2024-56654, DEBIAN-CVE-2024-56654, GHSA-h8m3-2hqh-wxmr, UBUNTU-CVE-2024-56654.