In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. __hci_cmd_sync_sk() returns NULL if a command returns a status event. However, it also returns NULL where an opcode doesn't exist in the hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0] for unknown opcodes. This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes status = skb->data[0]. KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci7 hci_power_on RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138 Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78 RSP: 0018:ffff888120bafac8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040 RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4 RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054 R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000 FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline] hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline] hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline] hci_init_sync net/bluetooth/hci_sync.c:4742 [inline] hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline] hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994 hci_dev_do_open net/bluetooth/hci_core.c:483 [inline] hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015 process_one_work kernel/workqueue.c:3267 [inline] process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348 worker_thread+0x91f/0xe50 kernel/workqueue.c:3429 kthread+0x2cb/0x360 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5818 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5818-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 24, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2022-45888 CVE-2023-52812 CVE-2024-26952 CVE-2024-26954                      CVE-2024-35964 CVE-2024-36244 CVE-2024-36478 CVE-2024-36914                      CVE-2024-36915 CVE-2024-36923 CVE-2024-38540 CVE-2024-38553                      CVE-2024-41080 CVE-2024-42322 CVE-2024-43868 CVE-2024-43904                      CVE-2024-43911 CVE-2024-44949 CVE-2024-49950 CVE-2024-49960                      CVE-2024-49974 CVE-2024-49986 CVE-2024-49991 CVE-2024-50012                      CVE-2024-50036 CVE-2024-50067 CVE-2024-50072 CVE-2024-50126                      CVE-2024-50215 CVE-2024-50218 CVE-2024-50228 CVE-2024-50229                      CVE-2024-50230 CVE-2024-50232 CVE-2024-50233 CVE-2024-50234                      CVE-2024-50235 CVE-2024-50236 CVE-2024-50237 CVE-2024-50242                      CVE-2024-50243 CVE-2024-50244 CVE-2024-50245 CVE-2024-50247                      CVE-2024-50249 CVE-2024-50250 CVE-2024-50251 CVE-2024-50252                      CVE-2024-50255 CVE-2024-50256 CVE-2024-50257 CVE-2024-50259                      CVE-2024-50261 CVE-2024-50262 CVE-2024-50264 CVE-2024-50265                      CVE-2024-50267 CVE-2024-50268 CVE-2024-50269 CVE-2024-50271                      CVE-2024-50272 CVE-2024-50273 CVE-2024-50276 CVE-2024-50278                      CVE-2024-50279 CVE-2024-50280 CVE-2024-50282 CVE-2024-50283                      CVE-2024-50284 CVE-2024-50286 CVE-2024-50287 CVE-2024-50290                      CVE-2024-50292 CVE-2024-50295 CVE-2024-50296 CVE-2024-50299                      CVE-2024-50301 CVE-2024-50302 CVE-2024-53042 CVE-2024-53043                      CVE-2024-53052 CVE-2024-53054 CVE-2024-53055 CVE-2024-53057                      CVE-2024-53058 CVE-2024-53059 CVE-2024-53060 CVE-2024-53061                      CVE-2024-53063 CVE-2024-53066 CVE-2024-53070 CVE-2024-53072                      CVE-2024-53081 CVE-2024-53082 CVE-2024-53088 CVE-2024-53093

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (bookworm), these problems have been fixed in     version 6.1.119-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2024-50255

medium

Tenable Plugins

high