CVE-2024-50077
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-50077
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50077.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-50077
- Downstream
- Related
- Published
- 2024-10-29T00:50:19Z
- Modified
- 2025-10-15T17:38:53.315224Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Bluetooth: ISO: Fix multiple init when debugfs is disabled
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix multiple init when debugfs is disabled
If btdebugfs is not created successfully, which happens if either CONFIGDEBUGFS or CONFIGDEBUGFSALLOWALL is unset, then isoinit() returns early and does not set isoinited to true. This means that a subsequent call to isoinit() will result in duplicate calls to protoregister(), btsock_register(), etc.
With CONFIGLISTHARDENED and CONFIGBUGONDATACORRUPTION enabled, the duplicate call to proto_register() triggers this BUG():
listadd double add: new=ffffffffc0b280d0, prev=ffffffffbab56250, next=ffffffffc0b280d0. ------------[ cut here ]------------ kernel BUG at lib/listdebug.c:35! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 887 Comm: bluetoothd Not tainted 6.10.11-1-ao-desktop #1 RIP: 0010:_listaddvalidorreport+0x9a/0xa0 ... _listaddvalidorreport+0x9a/0xa0 protoregister+0x2b5/0x340 isoinit+0x23/0x150 [bluetooth] setisosocketfunc+0x68/0x1b0 [bluetooth] kmemcachefree+0x308/0x330 hcisocksendmsg+0x990/0x9e0 [bluetooth] _socksendmsg+0x7b/0x80 sockwriteiter+0x9a/0x110 doiterreadvwritev+0x11d/0x220 vfswritev+0x180/0x3e0 dowritev+0xca/0x100 ...
This change removes the early return. The check for isodebugfs being NULL was unnecessary, it is always NULL when isoinited is false.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/8fb8e912afb4c47dec12ea9a5853e7a8db95816f
- https://git.kernel.org/stable/c/a9b7b535ba192c6b77e6c15a4c82d853163eab8c
- https://git.kernel.org/stable/c/adf1b179c2ff8073c24bf87e5a605fcc5a09798b
- https://git.kernel.org/stable/c/fa4b832c5a6ec35023a1b997cf658c436619c752
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedccf74f2390d60a2f9a75ef496d2564abb478f46aFixedfa4b832c5a6ec35023a1b997cf658c436619c752
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedccf74f2390d60a2f9a75ef496d2564abb478f46aFixed8fb8e912afb4c47dec12ea9a5853e7a8db95816f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedccf74f2390d60a2f9a75ef496d2564abb478f46aFixedadf1b179c2ff8073c24bf87e5a605fcc5a09798b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedccf74f2390d60a2f9a75ef496d2564abb478f46aFixeda9b7b535ba192c6b77e6c15a4c82d853163eab8c