CVE-2024-53237

Summary

CVE-2024-53237 is a vulnerability impacting the Linux kernel's Bluetooth subsystem. The issue involves a use-after-free condition in the `device_for_each_child()` function, leading to a kernel address being read by an unprivileged task. The bug was identified through a KASAN splat during a call to `device_for_each_child()`, which resulted in a memory leak and subsequent use of the freed memory by another task. This can potentially result in arbitrary code execution or denial-of-service scenarios. The issue has been resolved, but the vulnerability underscores the importance of proper memory management in kernel code. In some scenarios, a device registration and deregistration sequence could lead to a dangling pointer, which can be mitigated by explicitly reparenting to NULL to avoid the risk of using a freed parent.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.