CVE-2024-36013

What it actually does

Use-after-free in Linux kernel Bluetooth L2CAP channel handling where a chan structure is freed during l2cap_conn_del while still referenced in l2cap_connect after the chan_lock mutex is released, leading to slab corruption on subsequent access.

Why it matters to the business

Potential remote code execution or denial of service on Linux-based systems and devices using Bluetooth, increasing risk of compromise especially for embedded or mobile platforms with high ecosystem prevalence; urgency is moderate given low EPSS and no KEV status but fixed version available since 2024.

How an attack unfolds

An attacker sends crafted Bluetooth L2CAP signaling packets over BR/EDR to trigger l2cap_bredr_sig_cmd calling l2cap_connect, which allocates a chan and adds it to the list; concurrent l2cap_conn_del frees the chan while the original context later accesses freed memory in conf_state checks, potentially allowing memory corruption. Threat actor references to Android kernel RCE highlight relevance to mobile Linux variants.

How to fix it

Apply the upstream fix from commit cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 in the Linux kernel stable repository; rebuild and deploy updated kernels to all affected systems. For backports ensure the full patch including void return type change is included.

How to confirm the fix worked

Verify kernel source contains commit cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 or later; recompile with KASAN enabled and confirm absence of slab-use-after-free reports in l2cap_connect during Bluetooth connection stress tests.

Typical attack path

1. Establish Bluetooth connection to target device
2. Send malicious L2CAP signaling commands to invoke l2cap_connect
3. Trigger concurrent channel deletion via connection teardown or error paths
4. Cause use-after-free access to freed chan structure
5. Leverage corruption for code execution or crash

How to detect it

Search kernel logs and dmesg for KASAN slab-use-after-free reports referencing l2cap_connect or instrument_atomic_read in net/bluetooth/l2cap_core.c; examine Bluetooth connection teardown sequences for concurrent channel operations.

• BUG: KASAN: slab-use-after-free in l2cap_connect
• l2cap_connect+0xa67
• Read of size 8 at addr .* by task kworker

What your security team should do

• Prioritize kernel updates to the fixed commit across all Linux distributions and embedded devices
• Disable Bluetooth where not required as a temporary mitigation
• Monitor for kernel oops or KASAN reports involving l2cap_core.c
• Review downstream dependents for affected Android or embedded builds