Bug 2320594 (CVE-2024-50044) - CVE-2024-50044 kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Summary: CVE-2024-50044 kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_...
Keywords:
Status: NEW
Alias: CVE-2024-50044
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2320924
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-21 20:01 UTC by OSIDB Bzimport
Modified: 2025-05-13 08:31 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:6966 0 None None None 2025-05-13 08:31:04 UTC

Description OSIDB Bzimport 2024-10-21 20:01:59 UTC
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change

rfcomm_sk_state_change attempts to use sock_lock so it must never be
called with it locked but rfcomm_sock_ioctl always attempt to lock it
causing the following trace:

======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73

but task is already holding lock:
ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491

Comment 1 Avinash Hanwate 2024-10-22 11:22:08 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102133-CVE-2024-50044-2ee1@gregkh/T

Comment 2 Avinash Hanwate 2024-10-22 12:49:00 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102133-CVE-2024-50044-2ee1@gregkh/T

Comment 3 Avinash Hanwate 2024-10-22 12:52:57 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102133-CVE-2024-50044-2ee1@gregkh/T

Comment 4 errata-xmlrpc 2025-05-13 08:31:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966


Note You need to log in before you can comment on or make changes to this bug.