| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-46749: Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() |
| |
| This adds a check before freeing the rx->skb in flush and close |
| functions to handle the kernel crash seen while removing driver after FW |
| download fails or before FW download completes. |
| |
| dmesg log: |
| [ 54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080 |
| [ 54.643398] Mem abort info: |
| [ 54.646204] ESR = 0x0000000096000004 |
| [ 54.649964] EC = 0x25: DABT (current EL), IL = 32 bits |
| [ 54.655286] SET = 0, FnV = 0 |
| [ 54.658348] EA = 0, S1PTW = 0 |
| [ 54.661498] FSC = 0x04: level 0 translation fault |
| [ 54.666391] Data abort info: |
| [ 54.669273] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 |
| [ 54.674768] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 |
| [ 54.674771] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 |
| [ 54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000 |
| [ 54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000 |
| [ 54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP |
| [ 54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse |
| [ 54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2 |
| [ 54.744364] Hardware name: FSL i.MX8MM EVK board (DT) |
| [ 54.744368] Workqueue: hci0 hci_power_on |
| [ 54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| [ 54.757249] pc : kfree_skb_reason+0x18/0xb0 |
| [ 54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart] |
| [ 54.782921] sp : ffff8000805ebca0 |
| [ 54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000 |
| [ 54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230 |
| [ 54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92 |
| [ 54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff |
| [ 54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857 |
| [ 54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642 |
| [ 54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688 |
| [ 54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000 |
| [ 54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000 |
| [ 54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac |
| [ 54.857599] Call trace: |
| [ 54.857601] kfree_skb_reason+0x18/0xb0 |
| [ 54.863878] btnxpuart_flush+0x40/0x58 [btnxpuart] |
| [ 54.863888] hci_dev_open_sync+0x3a8/0xa04 |
| [ 54.872773] hci_power_on+0x54/0x2e4 |
| [ 54.881832] process_one_work+0x138/0x260 |
| [ 54.881842] worker_thread+0x32c/0x438 |
| [ 54.881847] kthread+0x118/0x11c |
| [ 54.881853] ret_from_fork+0x10/0x20 |
| [ 54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400) |
| [ 54.896410] ---[ end trace 0000000000000000 ]--- |
| |
| The Linux kernel CVE team has assigned CVE-2024-46749 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.4 with commit ab3a769b4dccec2cf60f0a0700b140991bf9afc8 and fixed in 6.6.51 with commit 013dae4735d2010544d1f2121bdeb8e6c9ea171e |
| Issue introduced in 6.4 with commit ab3a769b4dccec2cf60f0a0700b140991bf9afc8 and fixed in 6.10.10 with commit 056e0cd381d59a9124b7c43dd715e15f56a11635 |
| Issue introduced in 6.4 with commit ab3a769b4dccec2cf60f0a0700b140991bf9afc8 and fixed in 6.11 with commit c68bbf5e334b35b36ac5b9f0419f1f93f796bad1 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-46749 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/bluetooth/btnxpuart.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/013dae4735d2010544d1f2121bdeb8e6c9ea171e |
| https://git.kernel.org/stable/c/056e0cd381d59a9124b7c43dd715e15f56a11635 |
| https://git.kernel.org/stable/c/c68bbf5e334b35b36ac5b9f0419f1f93f796bad1 |
