In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcievent: Fix using rcuread_(un)lock while iterating
The usage of rcuread(un)lock while inside listforeachentryrcu is not safe since for the most part entries fetched this way shall be treated as rcu_dereference:
Note that the value returned by rcu_dereference() is valid
only within the enclosing RCU read-side critical section [1]_.
For example, the following is **not** legal::
rcu_read_lock();
p = rcu_dereference(head.next);
rcu_read_unlock();
x = p->address; /* BUG!!! */
rcu_read_lock();
y = p->data; /* BUG!!! */
rcu_read_unlock();
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56654.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56654.json"
[
{
"id": "CVE-2024-56654-14cb5d62",
"signature_type": "Function",
"digest": {
"function_hash": "122862719825547755103290703078069987802",
"length": 1083.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0108132d7d76d884e443d18b4f067cdf2811911b",
"target": {
"function": "hci_le_create_big_complete_evt",
"file": "net/bluetooth/hci_event.c"
},
"deprecated": false
},
{
"id": "CVE-2024-56654-341845a1",
"signature_type": "Function",
"digest": {
"function_hash": "122862719825547755103290703078069987802",
"length": 1083.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@581dd2dc168fe0ed2a7a5534a724f0d3751c93ae",
"target": {
"function": "hci_le_create_big_complete_evt",
"file": "net/bluetooth/hci_event.c"
},
"deprecated": false
},
{
"id": "CVE-2024-56654-911caade",
"signature_type": "Function",
"digest": {
"function_hash": "122862719825547755103290703078069987802",
"length": 1083.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9ecc90b5d501b3a5a62d0685d5104f934bb0104",
"target": {
"function": "hci_le_create_big_complete_evt",
"file": "net/bluetooth/hci_event.c"
},
"deprecated": false
},
{
"id": "CVE-2024-56654-e418882b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234865327691817271839294899756695791166",
"264166741949504152975111919822695022005",
"96626681623673560474367228421845471506",
"98491671860876121986545990909241048854",
"137220462430649530649900884031466490462",
"292840400229421252692090415714822394146",
"336026037005352185343628995860205530414",
"279800236901612040540092962111095551684",
"232933100181352364695357463601039533409",
"175224865397933042772602569121101415289",
"7699513821524179001370681786917274561",
"187312601564694286082308133584685853040",
"63985296115466863654562138161624299350",
"145901462044295551471149228370795427173",
"24822215768793844865775925167080564025",
"26984766782443876779225406963804929229",
"264186258241022217595330670691329900118",
"157779333268512756826283770080871697228",
"248267610455880448225770938972557804567",
"140835322640275284795148981947511079023",
"335391574320037549833112435638906832480",
"153953939355317666278519398929008739405",
"230250273074701478458089882374598813441",
"44209473820152166902962222686960116347",
"203540783759739283108333074371531402135",
"245271660362256105291518897526625688883",
"257164299398221832517988090110610283883",
"272472067544654346218314249803145630192"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@581dd2dc168fe0ed2a7a5534a724f0d3751c93ae",
"target": {
"file": "net/bluetooth/hci_event.c"
},
"deprecated": false
},
{
"id": "CVE-2024-56654-e76eb004",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234865327691817271839294899756695791166",
"264166741949504152975111919822695022005",
"96626681623673560474367228421845471506",
"98491671860876121986545990909241048854",
"137220462430649530649900884031466490462",
"292840400229421252692090415714822394146",
"336026037005352185343628995860205530414",
"279800236901612040540092962111095551684",
"232933100181352364695357463601039533409",
"175224865397933042772602569121101415289",
"7699513821524179001370681786917274561",
"187312601564694286082308133584685853040",
"63985296115466863654562138161624299350",
"145901462044295551471149228370795427173",
"24822215768793844865775925167080564025",
"26984766782443876779225406963804929229",
"264186258241022217595330670691329900118",
"157779333268512756826283770080871697228",
"248267610455880448225770938972557804567",
"140835322640275284795148981947511079023",
"335391574320037549833112435638906832480",
"153953939355317666278519398929008739405",
"230250273074701478458089882374598813441",
"44209473820152166902962222686960116347",
"203540783759739283108333074371531402135",
"245271660362256105291518897526625688883",
"257164299398221832517988090110610283883",
"272472067544654346218314249803145630192"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9ecc90b5d501b3a5a62d0685d5104f934bb0104",
"target": {
"file": "net/bluetooth/hci_event.c"
},
"deprecated": false
},
{
"id": "CVE-2024-56654-e91106fd",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234865327691817271839294899756695791166",
"264166741949504152975111919822695022005",
"96626681623673560474367228421845471506",
"98491671860876121986545990909241048854",
"137220462430649530649900884031466490462",
"292840400229421252692090415714822394146",
"336026037005352185343628995860205530414",
"279800236901612040540092962111095551684",
"232933100181352364695357463601039533409",
"175224865397933042772602569121101415289",
"7699513821524179001370681786917274561",
"187312601564694286082308133584685853040",
"63985296115466863654562138161624299350",
"145901462044295551471149228370795427173",
"24822215768793844865775925167080564025",
"26984766782443876779225406963804929229",
"264186258241022217595330670691329900118",
"157779333268512756826283770080871697228",
"248267610455880448225770938972557804567",
"140835322640275284795148981947511079023",
"335391574320037549833112435638906832480",
"153953939355317666278519398929008739405",
"230250273074701478458089882374598813441",
"44209473820152166902962222686960116347",
"203540783759739283108333074371531402135",
"245271660362256105291518897526625688883",
"257164299398221832517988090110610283883",
"272472067544654346218314249803145630192"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0108132d7d76d884e443d18b4f067cdf2811911b",
"target": {
"file": "net/bluetooth/hci_event.c"
},
"deprecated": false
}
]