CVE-2024-35851

What it actually does

A NULL pointer dereference occurs in the Qualcomm Bluetooth HCI UART driver when wakeup is called on a non-serdev registered controller during system suspend, leading to a kernel crash.

Why it matters to the business

Systems using affected Linux kernel versions with Qualcomm ROME Bluetooth controllers may experience unexpected crashes or instability during suspend operations, potentially disrupting operations and requiring restarts.

How an attack unfolds

An attacker would need to trigger a system suspend on a vulnerable device with the specific Bluetooth configuration, causing the NULL dereference. This appears to be primarily a stability issue rather than a direct remote exploit by named threat actors.

How to fix it

Update the Linux kernel to the fixed commit 52f9041deaca3fc5c40ef3b9cb943993ec7d2489 or later stable versions that include the missing sanity check for the serdev pointer.

How to confirm the fix worked

Verify the kernel source includes the NULL check before accessing the serdev pointer in the qca wakeup function, or test suspend/resume cycles on affected hardware configurations.

Typical attack path

1. Identify a vulnerable system with Qualcomm Bluetooth hardware registered via line discipline
2. Trigger system suspend
3. Cause NULL dereference in qca wakeup path leading to kernel crash

How to detect it

Inspect kernel logs and dmesg output for NULL pointer dereference or oops traces mentioning qca, hci_uart, or suspend paths on systems with Qualcomm Bluetooth controllers.

What your security team should do

• Apply the kernel update containing commit 52f9041deaca3fc5c40ef3b9cb943993ec7d2489 to affected systems promptly
• Review system logs for oops or panic messages referencing hci_qca or bluetooth suspend paths
• Test Bluetooth suspend behavior after patching