Heimdall Security Logo

CVE-2024-41063

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, da4569d450b193e39e87119fd316c0291b585d14, 5.15.151, 6.10, 98fb98fd37e42fd4ce13ff657ea64503e24b6090, 0, 4.19.309, 2ab9a19d896f5a0dd386e1f001c5309bc35f433b, 6.1.101, 6.8, <96600c2e5ee8213dbab5df1617293d8e847bb4fa, <5.4.281, 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2, <6.8, 2449007d3f73b2842c9734f45f0aadb522daf592, <6.6.42, 6.6.42, 6.1.81, <=5.10.*, 5.15.164, <=6.6.*, <d2ce562a5aff1dcd0c50d9808ea825ef90da909f, <=6.9.*, 6.9.11, 5.4.271, 5.10.223, <0d151a103775dd9645c78c97f77d6e2a5298d913, 45085686b9559bfbe3a4f41d3d695a520668f5e1, <=5.4.*, <ddeda6ca5f218b668b560d90fc31ae469adbfd92, dd594cdc24f2e48dab441732e6dfcafd6b0711d1, <=4.19.*, <d6cbce18370641a21dd889e8613d8153df15eb39, <9cfc84b1d464cc024286f42a090718f9067b80ed, 4.19.319, <5.15.164, <=*, 5.10.212, <=5.15.*, 5.4.281, 6.6.21, <3f939bd73fed12dddc2a32a76116c19ca47c7678, <5.10.223, <48542881997e17b49dc16b93fe910e0cfcf7a9f9, <6.1.101, 6.7.9, e0b278650f07acf2e0932149183458468a731c03, <4.19.319

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destroy_workqueue(), for hci_error_reset() is called from hdev->req_workqueue which destroy_workqueue() needs to flush. We need to make sure that hdev->{rx_work,cmd_work,tx_work} which are queued into hdev->workqueue and hdev->{power_on,error_reset} which are queued into hdev->req_workqueue are no longer running by the moment destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); are called from hci_release_dev(). Call cancel_work_sync() on these work items from hci_unregister_dev() as soon as hdev->list is removed from hci_dev_list.

Gravité et risque d'exploitation

CVE-2024-41063 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 7.4 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, da4569d450b193e39e87119fd316c0291b585d14, 5.15.151, 6.10, 98fb98fd37e42fd4ce13ff657ea64503e24b6090, 0, 4.19.309, 2ab9a19d896f5a0dd386e1f001c5309bc35f433b, 6.1.101, 6.8, <96600c2e5ee8213dbab5df1617293d8e847bb4fa, <5.4.281, 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2, <6.8, 2449007d3f73b2842c9734f45f0aadb522daf592, <6.6.42, 6.6.42, 6.1.81, <=5.10.*, 5.15.164, <=6.6.*, <d2ce562a5aff1dcd0c50d9808ea825ef90da909f, <=6.9.*, 6.9.11, 5.4.271, 5.10.223, <0d151a103775dd9645c78c97f77d6e2a5298d913, 45085686b9559bfbe3a4f41d3d695a520668f5e1, <=5.4.*, <ddeda6ca5f218b668b560d90fc31ae469adbfd92, dd594cdc24f2e48dab441732e6dfcafd6b0711d1, <=4.19.*, <d6cbce18370641a21dd889e8613d8153df15eb39, <9cfc84b1d464cc024286f42a090718f9067b80ed, 4.19.319, <5.15.164, <=*, 5.10.212, <=5.15.*, 5.4.281, 6.6.21, <3f939bd73fed12dddc2a32a76116c19ca47c7678, <5.10.223, <48542881997e17b49dc16b93fe910e0cfcf7a9f9, <6.1.101, 6.7.9, e0b278650f07acf2e0932149183458468a731c03, <4.19.319) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE