CVE-2024-50077— Bluetooth: ISO: Fix multiple init when debugfs is disabled
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-50077
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluetooth: ISO: Fix multiple init when debugfs is disabled
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix multiple init when debugfs is disabled If bt_debugfs is not created successfully, which happens if either CONFIG_DEBUG_FS or CONFIG_DEBUG_FS_ALLOW_ALL is unset, then iso_init() returns early and does not set iso_inited to true. This means that a subsequent call to iso_init() will result in duplicate calls to proto_register(), bt_sock_register(), etc. With CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION enabled, the duplicate call to proto_register() triggers this BUG(): list_add double add: new=ffffffffc0b280d0, prev=ffffffffbab56250, next=ffffffffc0b280d0. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1 RIP: 0010:__list_add_valid_or_report+0x9a/0xa0 ... __list_add_valid_or_report+0x9a/0xa0 proto_register+0x2b5/0x340 iso_init+0x23/0x150 [bluetooth] set_iso_socket_func+0x68/0x1b0 [bluetooth] kmem_cache_free+0x308/0x330 hci_sock_sendmsg+0x990/0x9e0 [bluetooth] __sock_sendmsg+0x7b/0x80 sock_write_iter+0x9a/0x110 do_iter_readv_writev+0x11d/0x220 vfs_writev+0x180/0x3e0 do_writev+0xca/0x100 ... This change removes the early return. The check for iso_debugfs being NULL was unnecessary, it is always NULL when iso_inited is false.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在ISO初始化时未正确处理调试文件系统，导致在模块卸载时出现双重初始化问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50077
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50077
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-10-29 · 21 CVEs total
| CVE-2024-50078 | Bluetooth: Call iso_exit() on module unload | |
| CVE-2024-50068 | mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets() | |
| CVE-2024-50069 | pinctrl: apple: check devm_kasprintf() returned value | |
| CVE-2024-50070 | pinctrl: stm32: check devm_kasprintf() returned value | |
| CVE-2024-50071 | pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() | |
| CVE-2024-50072 | x86/bugs: Use code segment selector for VERW operand | |
| CVE-2024-50073 | tty: n_gsm: Fix use-after-free in gsm_cleanup_mux | |
| CVE-2024-50074 | parport: Proper fix for array out-of-bounds access | |
| CVE-2024-50075 | xhci: tegra: fix checked USB2 port number | |
| CVE-2024-50076 | vt: prevent kernel-infoleak in con_font_get() | |
| CVE-2024-50088 | btrfs: fix uninitialized pointer free in add_inode_ref() | |
| CVE-2024-50079 | io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work | |
| CVE-2024-50080 | ublk: don't allow user copy for unprivileged device | |
| CVE-2024-50081 | blk-mq: setup queue ->tag_set before initializing hctx | |
| CVE-2024-50082 | blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race | |
| CVE-2024-50083 | tcp: fix mptcp DSS corruption due to large pmtu xmit | |
| CVE-2024-50084 | net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() | |
| CVE-2024-50085 | mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow | |
| CVE-2024-50086 | ksmbd: fix user-after-free from session log off | |
| CVE-2024-50087 | btrfs: fix uninitialized pointer free on read_alloc_one_name() error |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2024-50077
No comments yet