Possible UAF in bt_accept_poll in Linux kernel
CVE-2024-21803

7.8HIGH

Key Information:

Vendor
Linux
Status
Linux kernel
Vendor
CVE Published:
30 January 2024

Summary

A Use After Free vulnerability resides within the Bluetooth modules of the Linux kernel, impacting both x86 and ARM architectures. This vulnerability permits an attacker to execute arbitrary code locally. The flaw exists in the handling of memory resources within the Bluetooth framework, specifically within the code found in the file related to Bluetooth address families. Affected versions range from v2.6.12-rc2 through to versions prior to v6.8-rc1, underscoring the necessity for users to remain vigilant and apply necessary updates or mitigations to protect their systems.

Affected Version(s)

Linux kernel Linux v2.6.12-rc2

References

https://bugzilla.openanolis.cn/show_bug.cgi?id=8081

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

胡宇轩 <[email protected]>
.