Skip to content
Heist/ feed
HighFix available

DEBIAN-CVE-2024-41062

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data. Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.

Announced Group revision 1
Original source ↗

DEBIAN-CVE-2024-41062

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2024-41062

linux

Source reference: /affected/0/package/name

Affected versions
6.1.27-1

Source reference: /affected/0/versions

6.1.37-1

Source reference: /affected/0/versions

6.1.38-1

Source reference: /affected/0/versions

6.1.38-2

Source reference: /affected/0/versions

6.1.38-2~bpo11+1

Source reference: /affected/0/versions

6.1.38-3

Source reference: /affected/0/versions

6.1.38-4

Source reference: /affected/0/versions

6.1.38-4~bpo11+1

Source reference: /affected/0/versions

6.1.52-1

Source reference: /affected/0/versions

6.1.55-1

Source reference: /affected/0/versions

6.1.55-1~bpo11+1

Source reference: /affected/0/versions

6.1.64-1

Source reference: /affected/0/versions

6.1.66-1

Source reference: /affected/0/versions

6.1.67-1

Source reference: /affected/0/versions

6.1.69-1

Source reference: /affected/0/versions

6.1.69-1~bpo11+1

Source reference: /affected/0/versions

6.1.76-1

Source reference: /affected/0/versions

6.1.76-1~bpo11+1

Source reference: /affected/0/versions

6.1.82-1

Source reference: /affected/0/versions

6.1.85-1

Source reference: /affected/0/versions

6.1.90-1

Source reference: /affected/0/versions

6.1.90-1~bpo11+1

Source reference: /affected/0/versions

6.1.94-1

Source reference: /affected/0/versions

6.1.94-1~bpo11+1

Source reference: /affected/0/versions

6.1.98-1

Source reference: /affected/0/versions

6.1.99-1

Source reference: /affected/0/versions

Fixed versions
6.1.106-1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

linux

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
6.9.11-1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

linux

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
6.9.11-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.1.106-1"
          }
        ]
      }
    ],
    "package": {
      "name": "linux",
      "purl": "pkg:deb/debian/linux?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "6.1.27-1",
      "6.1.37-1",
      "6.1.38-1",
      "6.1.38-2",
      "6.1.38-2~bpo11+1",
      "6.1.38-3",
      "6.1.38-4",
      "6.1.38-4~bpo11+1",
      "6.1.52-1",
      "6.1.55-1",
      "6.1.55-1~bpo11+1",
      "6.1.64-1",
      "6.1.66-1",
      "6.1.67-1",
      "6.1.69-1",
      "6.1.69-1~bpo11+1",
      "6.1.76-1",
      "6.1.76-1~bpo11+1",
      "6.1.82-1",
      "6.1.85-1",
      "6.1.90-1",
      "6.1.90-1~bpo11+1",
      "6.1.94-1",
      "6.1.94-1~bpo11+1",
      "6.1.98-1",
      "6.1.99-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41062.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.9.11-1"
          }
        ]
      }
    ],
    "package": {
      "name": "linux",
      "purl": "pkg:deb/debian/linux?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41062.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.9.11-1"
          }
        ]
      }
    ],
    "package": {
      "name": "linux",
      "purl": "pkg:deb/debian/linux?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41062.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2024-41062

Source reference: /upstream

Publisher severity

medium

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2024-41062 · High

Linux, Linux

Event
#81496 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. DEBIAN-CVE-2024-41062 · Revision 1Source updated