In the Linux kernel, a critical vulnerability (CVE-2024-26886) has been identified and resolved. This vulnerability relates to the Bluetooth subsystem, specifically the af_bluetooth module, and causes a deadlock in certain situations. A deadlock is a situation where two or more parts of a computer program are waiting for each other to release a resource, and thus, neither can proceed with their operation.
In this case, the deadlock occurs while attempting to perform a sock_lock on the .recvmsg method which blocks tasks for an extended period, leading to performance degradation and potential crashes. The resolution involves changing the locking mechanism from using sock_sock to sk_receive_queue.lock on the bt_sock_ioctl function to avoid the use-after-free (UAF) condition. The following code snippet illustrates the change:
Before (deadlock situation)
lock_sock_nested+x43/x50
l2cap_sock_recv_cb+x21/xa
l2cap_recv_frame+x55b/x30a
After (avoiding deadlock)
/* change to sk_receive_queue.lock on bt_sock_ioctl to avoid UAF */
lock_sock_nested+x43/x50
l2cap_sock_recv_cb+x21/xa
l2cap_recv_frame+x55b/x30a
This modification is now part of the Linux kernel and has been made available to the community through the official repositories.
Here are the links to the original references
- Linux Kernel Mailing List - Bluetooth deadlock fix proposal
- Kernel.org - Patch fixing Bluetooth deadlock in the Linux kernel
Exploit Details
Affected systems: Linux kernel versions prior to the patch for CVE-2024-26886
Attack vector: An attacker with local access could initiate a series of operations on unpatched systems, leading to a deadlock in the Bluetooth subsystem, causing performance degradation, or even system crashes in extreme cases.
Impact: High
Mitigation: Apply the patch provided by the Linux kernel community or update to a newer Linux kernel version that includes the fix.
In conclusion, administrators of Linux-based systems should take this vulnerability very seriously and consider applying the patch provided by the Linux kernel community or updating their systems to a more recent version containing the fix. With such actions, the risk of performance degradation and system crashes due to CVE-2024-26886 will be significantly reduced.
Timeline
Published on: 04/17/2024 11:15:10 UTC
Last modified on: 12/04/2024 18:15:13 UTC