CVE-2024-56604
CVSS 3.1 Score 7.8 of 10 (high)
Details
Published Dec 27, 2024
Updated: Feb 11, 2025
CWE ID 416
Summary
CVE-2024-56604 is a newly identified vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem. The issue involves a dangling pointer left in the sock object when an SK object allocated by bt_sock_alloc() fails to be attached due to rfcomm_dlc_alloc() failing. This can result in a use-after-free condition, potentially leading to arbitrary code execution or denial-of-service attacks. The vulnerability has been mitigated by swapping the order of calls to bt_sock_alloc() and rfcomm_dlc_alloc().
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.