CVE-2024-43884

What it actually does

NULL pointer dereference in hci_conn_params_add() called from pair_device() in the Bluetooth MGMT subsystem causes kernel crash on invalid connection parameters.

Why it matters to the business

Unexpected system crashes on Linux hosts during Bluetooth device pairing disrupt operations and availability; widespread kernel deployment increases exposure across servers and endpoints.

How an attack unfolds

An attacker with local or adjacent access initiates a Bluetooth pairing operation that passes crafted parameters to pair_device(), triggering the unchecked NULL return from hci_conn_params_add() and dereferencing it to crash the kernel.

How to fix it

Update the Linux kernel to the fixed commit 11b4b0e63f2621b33b2e107407a7d67a65994ca1 or later stable releases containing the error-handling addition in pair_device().

How to confirm the fix worked

Confirm kernel source contains the added NULL check after hci_conn_params_add() call in net/bluetooth/mgmt.c; test pairing operations do not trigger oops or panic.

Typical attack path

1. Obtain local or Bluetooth-adjacent access to target Linux system
2. Trigger Bluetooth MGMT pair_device operation with invalid connection parameters
3. hci_conn_params_add returns NULL without check
4. NULL dereference occurs causing kernel panic and crash

How to detect it

Review kernel logs for Bluetooth-related NULL pointer dereference oops or panic entries around the time of pairing attempts; correlate with dmesg or journalctl entries mentioning mgmt or hci_conn_params_add.

• BUG: unable to handle kernel NULL pointer dereference
• RIP: hci_conn_params_add
• bluetooth: mgmt pair_device

What your security team should do

• Prioritize kernel updates on all systems exposing Bluetooth
• Disable Bluetooth MGMT interface where pairing is unnecessary
• Monitor for kernel oops in Bluetooth code paths