CVE-2024-56757 (GCVE-0-2024-56757)
Vulnerability from cvelistv5
Published
2025-01-06 16:20
Modified
2026-08-05 11:46
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregistering hci device when usb disconnect. Removing BT usb dongle without properly releasing the interface may cause Kernel panic while unregister hci device.
References
Impacted products
Vendor Product Version
Linux Linux Version: ceac1cb0259de682d78f5c784ef8e0b13022e9d9
Version: ceac1cb0259de682d78f5c784ef8e0b13022e9d9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:57:05.162593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-404",
                "description": "CWE-404 Improper Resource Shutdown or Release",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:01.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc569d791ab2a0de74f76e470515d25d24c9b84b",
              "status": "affected",
              "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9",
              "versionType": "git"
            },
            {
              "lessThan": "489304e67087abddc2666c5af0159cb95afdcf59",
              "status": "affected",
              "version": "ceac1cb0259de682d78f5c784ef8e0b13022e9d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\n\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is triggered by the USB disconnect/unbind path of the btusb driver, which is reachable locally without physical access via emulated USB (CONFIG_USB_RAW_GADGET/dummy_hcd, the same mechanism syzbot uses to reproduce the sibling btusb_disconnect UAFs) and via driver unbind, in addition to physical dongle removal. This matches the AV:L scoring of the directly analogous btusb disconnect-path UAFs CVE-2025-40283, CVE-2025-71082 and CVE-2025-21827.\nAC:L - No race is involved \u2014 usb_disable_device() unbinds interfaces in ascending order, so the never-released ISO interface (ifnum 2) is deterministically re-entered into btusb_disconnect() after btusb_data and hci_dev have already been freed. The attacker fully controls the device descriptors that cause the ISO interface to be claimed.\nPR:L - No capability or authorization check exists anywhere on the path; an unprivileged local user with access to an emulated-USB facility can drive probe and disconnect of a synthetic MediaTek dongle, so only basic local access is required.\nUI:N - The attacker performs the attach/detach themselves; no victim action is needed to reach the freed-object dereference.\nS:U - Both the vulnerable code and the corrupted objects (btusb_data, hci_dev with inline btmtk_data) live in the kernel\u0027s own security authority, with no crossing into a hypervisor or IOMMU boundary.\nC:H - A freed slab object is re-read (data-\u003ehdev, data-\u003eintf, data-\u003edisconnect) and freed hci_dev fields are dereferenced, so an attacker who reclaims the slab controls the contents that are read back, yielding an arbitrary-read primitive.\nI:H - The stale intf2 disconnect writes through freed pointers (usb_set_intfdata(data-\u003eintf, NULL)) and calls the freed function pointer data-\u003edisconnect, while orphaned isopkt URBs perform list_add writes into the freed hci_dev via usb_anchor_urb \u2014 a controllable write and control-flow hijack after heap spraying, compounded by the double hci_free_dev().\nA:H - The commit message itself states the bug causes a kernel panic while unregistering the hci device, and the use-after-free plus double-free reliably crashes the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:22.431Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b"
        },
        {
          "url": "https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59"
        }
      ],
      "title": "Bluetooth: btusb: mediatek: add intf release flow when usb disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56757",
    "datePublished": "2025-01-06T16:20:38.228Z",
    "dateReserved": "2024-12-29T11:26:39.761Z",
    "dateUpdated": "2026-08-05T11:46:22.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56757\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:57:05.162593Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-404\", \"description\": \"CWE-404 Improper Resource Shutdown or Release\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:50:10.889Z\"}}], \"cna\": {\"title\": \"Bluetooth: btusb: mediatek: add intf release flow when usb disconnect\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is triggered by the USB disconnect/unbind path of the btusb driver, which is reachable locally without physical access via emulated USB (CONFIG_USB_RAW_GADGET/dummy_hcd, the same mechanism syzbot uses to reproduce the sibling btusb_disconnect UAFs) and via driver unbind, in addition to physical dongle removal. This matches the AV:L scoring of the directly analogous btusb disconnect-path UAFs CVE-2025-40283, CVE-2025-71082 and CVE-2025-21827.\\nAC:L - No race is involved \\u2014 usb_disable_device() unbinds interfaces in ascending order, so the never-released ISO interface (ifnum 2) is deterministically re-entered into btusb_disconnect() after btusb_data and hci_dev have already been freed. The attacker fully controls the device descriptors that cause the ISO interface to be claimed.\\nPR:L - No capability or authorization check exists anywhere on the path; an unprivileged local user with access to an emulated-USB facility can drive probe and disconnect of a synthetic MediaTek dongle, so only basic local access is required.\\nUI:N - The attacker performs the attach/detach themselves; no victim action is needed to reach the freed-object dereference.\\nS:U - Both the vulnerable code and the corrupted objects (btusb_data, hci_dev with inline btmtk_data) live in the kernel\u0027s own security authority, with no crossing into a hypervisor or IOMMU boundary.\\nC:H - A freed slab object is re-read (data-\u003ehdev, data-\u003eintf, data-\u003edisconnect) and freed hci_dev fields are dereferenced, so an attacker who reclaims the slab controls the contents that are read back, yielding an arbitrary-read primitive.\\nI:H - The stale intf2 disconnect writes through freed pointers (usb_set_intfdata(data-\u003eintf, NULL)) and calls the freed function pointer data-\u003edisconnect, while orphaned isopkt URBs perform list_add writes into the freed hci_dev via usb_anchor_urb \\u2014 a controllable write and control-flow hijack after heap spraying, compounded by the double hci_free_dev().\\nA:H - The commit message itself states the bug causes a kernel panic while unregistering the hci device, and the use-after-free plus double-free reliably crashes the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ceac1cb0259de682d78f5c784ef8e0b13022e9d9\", \"lessThan\": \"cc569d791ab2a0de74f76e470515d25d24c9b84b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ceac1cb0259de682d78f5c784ef8e0b13022e9d9\", \"lessThan\": \"489304e67087abddc2666c5af0159cb95afdcf59\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/bluetooth/btusb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/bluetooth/btusb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b\"}, {\"url\": \"https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\\n\\nMediaTek claim an special usb intr interface for ISO data transmission.\\nThe interface need to be released before unregistering hci device when\\nusb disconnect. Removing BT usb dongle without properly releasing the\\ninterface may cause Kernel panic while unregister hci device.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.8\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:22.431Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56757\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:22.431Z\", \"dateReserved\": \"2024-12-29T11:26:39.761Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-06T16:20:38.228Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.