CVE-2024-35856

What it actually does

Double free of an skb buffer in the btusb mediatek driver during error handling in hci_devcd_append() within coredump processing.

Why it matters to the business

Kernel memory corruption or crashes on affected Linux systems using Mediatek Bluetooth hardware, leading to denial of service or potential escalation of privileges in high-value environments.

How an attack unfolds

An attacker triggers the coredump error path in the mediatek btusb driver through crafted Bluetooth operations that cause hci_devcd_append() to fail, resulting in the caller freeing an already-freed skb and enabling use-after-free exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit 80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1 or later stable releases that resolve the double-free in btusb mediatek coredump handling.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the affected versions; inspect btusb.c source for the corrected skb handling logic around hci_devcd_append().

Typical attack path

1. Identify systems with vulnerable Linux kernel and Mediatek Bluetooth USB devices
2. Send crafted Bluetooth packets or commands to induce coredump error condition
3. Trigger double-free via the skb handling bug in btusb mediatek coredump path
4. Exploit resulting use-after-free for memory corruption or code execution

How to detect it

Review kernel logs for double-free warnings, skb-related panics, or crashes in btusb or hci_devcd paths; correlate with Bluetooth activity around the time of the event.

What your security team should do

• Prioritize kernel updates on all systems with Mediatek Bluetooth hardware
• Monitor for kernel oops or panic logs related to skb double-free in Bluetooth drivers
• Restrict Bluetooth functionality where not required until patched