Bug 2334486 (CVE-2024-56590)

Summary:	CVE-2024-56590 kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free vulnerability was found in the Linux kernel. The Bluetooth firmware isn't checked if skb contains an ACL header, otherwise the code may attempt to access some uninitialized or invalid memory past the valid skb->data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-12-27 15:05:09 UTC

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet

This fixes not checking if skb really contains an ACL header otherwise
the code may attempt to access some uninitilized/invalid memory past the
valid skb->data.

Comment 1 Avinash Hanwate 2024-12-28 06:04:35 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122759-CVE-2024-56590-d4ba@gregkh/T

Comment 3 Avinash Hanwate 2024-12-29 04:45:40 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122759-CVE-2024-56590-d4ba@gregkh/T

Comment 6 errata-xmlrpc 2025-05-13 08:37:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966