CVE-2024-56591 (GCVE-0-2024-56591)
Vulnerability from cvelistv5
Published
2024-12-27 14:50
Modified
2026-08-05 11:45
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Use disable_delayed_work_sync This makes use of disable_delayed_work_sync instead cancel_delayed_work_sync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding the work is about to be freed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c
Version: 19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397",
              "status": "affected",
              "version": "19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c",
              "versionType": "git"
            },
            {
              "lessThan": "2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df",
              "status": "affected",
              "version": "19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Use disable_delayed_work_sync\n\nThis makes use of disable_delayed_work_sync instead\ncancel_delayed_work_sync as it not only cancel the ongoing work but also\ndisables new submit which is disarable since the object holding the work\nis about to be freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable teardown path lives in the Bluetooth HCI connection layer and is driven by connection setup/disconnect events from a peer device, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring convention Bluetooth reachability is Adjacent.\nAC:L - Although this is a race, the attacker controls both sides of it \u2014 repeatedly initiating and abruptly dropping L2CAP/LE connections drives `hci_conn_del()` on the HCI event path while concurrent channel teardown calls `hci_conn_drop()` and re-arms `disc_work`. The attempt can be retried indefinitely with no condition outside the attacker\u0027s influence.\nPR:N - No privileges on the target are required: L2CAP/LE connection establishment and teardown occur before pairing or authentication, and no capability check exists anywhere on the path from packet/event handling to `hci_conn_del()`.\nUI:N - The entire sequence is driven by attacker-initiated link establishment and disconnection handled automatically by the kernel\u0027s HCI event processing. No action by a local user or victim is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The re-armed delayed work leaves an armed timer and workqueue linkage inside a freed `hci_conn` slab object, and `hci_conn_timeout()`/`hci_conn_idle()` subsequently read attacker-groomed reallocated memory. This use-after-free gives an arbitrary kernel read primitive and can leak arbitrary kernel memory.\nI:H - `queue_delayed_work()`/`cancel_delayed_work()` write into the freed object, and the pending timer\u0027s `-\u003efunction` and the work\u0027s `-\u003efunc` are later dereferenced out of it, so heap spraying yields a controlled write and an indirect call \u2014 sufficient for control-flow hijack and kernel privilege escalation.\nA:H - Even unexploited, the use-after-free dereferences freed slab memory from timer softirq and workqueue context, producing KASAN splats, oopses, or a kernel panic, which syzbot reproduced reliably."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:13.959Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df"
        }
      ],
      "title": "Bluetooth: hci_conn: Use disable_delayed_work_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56591",
    "datePublished": "2024-12-27T14:50:58.674Z",
    "dateReserved": "2024-12-27T14:03:06.003Z",
    "dateUpdated": "2026-08-05T11:45:13.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.