CVE-2024-35933

What it actually does

Null pointer dereference in btintel_read_version when hci_cmd_sync_complete is triggered with a NULL skb, causing hdev->req_skb to be NULL and triggering a kernel crash.

Why it matters to the business

Local denial of service on Linux systems using Intel Bluetooth hardware, resulting in system instability or reboots that disrupt operations.

How an attack unfolds

An attacker with local user privileges triggers the Bluetooth Intel driver path by causing hci_cmd_sync_complete to receive a NULL skb, dereferencing the null pointer and crashing the kernel.

How to fix it

Update the Linux kernel to a version containing commit b19fe5eea619d54eea59bb8a37c0f8d00ef0e912 or later stable releases that resolve the null pointer handling in btintel_read_version.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source, confirm no NULL skb paths remain in btintel_read_version, and test Bluetooth command synchronization under error conditions.

Typical attack path

1. Obtain local user access on a Linux system with Intel Bluetooth
2. Trigger hci_cmd_sync_complete with NULL skb in btintel driver
3. Force dereference of hdev->req_skb
4. Induce kernel panic or oops

How to detect it

Review kernel logs for oops or panic entries referencing btintel_read_version or hci_cmd_sync_complete with NULL skb indicators.

• btintel_read_version
• hci_cmd_sync_complete.*NULL
• hdev->req_skb

What your security team should do

• Apply the referenced kernel commit or updated distribution packages immediately
• Prioritize systems with Intel Bluetooth hardware for patching
• Monitor kernel logs for btintel-related oops after deployment