CVE-2024-50029— Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth:hci_conn子系统中hci_enhanced_setup_sync函数中的释放后重用问题。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1068 · Exploitation for Privilege EscalationAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | e07a06b4eb417f5271d33ce2240e93c62d98b7b4< 9b666a0490379c860eab380dec19a864c0bc256b |
affected |
e07a06b4eb417f5271d33ce2240e93c62d98b7b4< 867639300759e3e1c5b1e1a5ff89231f263a32a7 |
affected | ||
e07a06b4eb417f5271d33ce2240e93c62d98b7b4< 98ccd44002d88cbf4edfc4480df532a3da5a013e |
affected | ||
e07a06b4eb417f5271d33ce2240e93c62d98b7b4< 18fd04ad856df07733f5bb07e7f7168e7443d393 |
affected | ||
6.1 |
affected | ||
< 6.1 |
unaffected | ||
6.1.188≤ 6.1.* |
unaffected | ||
6.6.57≤ 6.6.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-50029
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
This checks if the ACL connection remains valid as it could be destroyed
while hci_enhanced_setup_sync is pending on cmd_sync leading to the
following trace:
BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60
Read of size 1 at addr ffff888002328ffd by task kworker/u5:2/37
CPU: 0 UID: 0 PID: 37 Comm: kworker/u5:2 Not tainted 6.11.0-rc6-01300-g810be445d8d6 #7099
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
? hci_enhanced_setup_sync+0x91b/0xa60
print_report+0x152/0x4c0
? hci_enhanced_setup_sync+0x91b/0xa60
? __virt_addr_valid+0x1fa/0x420
? hci_enhanced_setup_sync+0x91b/0xa60
kasan_report+0xda/0x1b0
? hci_enhanced_setup_sync+0x91b/0xa60
hci_enhanced_setup_sync+0x91b/0xa60
? __pfx_hci_enhanced_setup_sync+0x10/0x10
? __pfx___mutex_lock+0x10/0x10
hci_cmd_sync_work+0x1c2/0x330
process_one_work+0x7d9/0x1360
? __pfx_lock_acquire+0x10/0x10
? __pfx_process_one_work+0x10/0x10
? assign_work+0x167/0x240
worker_thread+0x5b7/0xf60
? __kthread_parkme+0xac/0x1c0
? __pfx_worker_thread+0x10/0x10
? __pfx_worker_thread+0x10/0x10
kthread+0x293/0x360
? __pfx_kthread+0x10/0x10
ret_from_fork+0x2f/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 34:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x8f/0xa0
__hci_conn_add+0x187/0x17d0
hci_connect_sco+0x2e1/0xb90
sco_sock_connect+0x2a2/0xb80
__sys_connect+0x227/0x2a0
__x64_sys_connect+0x6d/0xb0
do_syscall_64+0x71/0x140
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 37:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x101/0x160
kfree+0xd0/0x250
device_release+0x9a/0x210
kobject_put+0x151/0x280
hci_conn_del+0x448/0xbf0
hci_abort_conn_sync+0x46f/0x980
hci_cmd_sync_work+0x1c2/0x330
process_one_work+0x7d9/0x1360
worker_thread+0x5b7/0xf60
kthread+0x293/0x360
ret_from_fork+0x2f/0x70
ret_from_fork_asm+0x1a/0x30
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于Bluetooth:hci_conn子系统中hci_enhanced_setup_sync函数中的释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50029
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50029
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-50029 (2)
Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total
| CVE-2024-49855 | 9.8 CRITICAL | nbd: fix race between timeout and normal completion |
| CVE-2024-50033 | 9.8 CRITICAL | slip: make slhc_remember() more robust against malicious packets |
| CVE-2024-50043 | 9.8 CRITICAL | nfsd: fix possible badness in FREE_STATEID |
| CVE-2024-50047 | 9.8 CRITICAL | smb: client: fix UAF in async decryption |
| CVE-2024-50046 | 9.8 CRITICAL | NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() |
| CVE-2024-47695 | 9.8 CRITICAL | RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds |
| CVE-2022-48985 | 9.8 CRITICAL | net: mana: Fix race on per-CQ variable napi work_done |
| CVE-2022-49003 | 9.8 CRITICAL | nvme: fix SRCU protection of nvme_ns_head list |
| CVE-2024-49996 | 9.4 CRITICAL | cifs: Fix buffer overflow when parsing NFS reparse points |
| CVE-2024-47678 | 9.4 CRITICAL | icmp: change the order of rate limits |
| CVE-2024-49930 | 8.8 HIGH | wifi: ath11k: fix array out-of-bound access in SoC stats |
| CVE-2022-48967 | 8.8 HIGH | NFC: nci: Bounds check struct nfc_target arrays |
| CVE-2022-48964 | 8.8 HIGH | ravb: Fix potential use-after-free in ravb_rx_gbeth() |
| CVE-2022-48962 | 8.8 HIGH | net: hisilicon: Fix potential use-after-free in hisi_femac_rx() |
| CVE-2022-48960 | 8.8 HIGH | net: hisilicon: Fix potential use-after-free in hix5hd2_rx() |
| CVE-2024-50041 | 8.8 HIGH | i40e: Fix macvlan leak by synchronizing access to mac_filter_hash |
| CVE-2024-49950 | 8.8 HIGH | Bluetooth: L2CAP: Fix uaf in l2cap_connect |
| CVE-2024-49939 | 8.8 HIGH | wifi: rtw89: avoid to add interface to list twice when SER |
| CVE-2022-48954 | 8.8 HIGH | s390/qeth: fix use-after-free in hsci |
| CVE-2024-49936 | 8.8 HIGH | net/xen-netback: prevent UAF in xenvif_flush_hash() |
Showing top 20 of 372 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2024-50029
No comments yet