Cloudanix VulnDB

CVE-2024-46749

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Sep 18, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in Linux Bluetooth driver handling can crash the entire system when certain startup operations fail.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in btnxpuart_flush() and close paths when rx->skb is freed without validating the rx pointer, triggered on driver removal after failed or incomplete firmware download, resulting in kernel panic (Oops).

Why it matters to the business

Unexpected system crashes and reboots on Linux devices using the affected Bluetooth UART driver, causing operational downtime, loss of Bluetooth functionality, and potential data corruption during critical operations.

How an attack unfolds

An attacker with local access triggers firmware download failure or incomplete initialization in the btnxpuart driver, then unloads the module or triggers hci_power_on, causing the kernel to dereference a null pointer in kfree_skb_reason and panic the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 013dae4735d2010544d1f2121bdeb8e6c9ea171e or later; rebuild and deploy the fixed btnxpuart module; avoid manual removal of the driver until patched.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable versions; reproduce driver load/unload after simulated firmware failure and confirm absence of the NULL dereference Oops in dmesg.

Typical attack path

  1. Cause or wait for Bluetooth firmware download to fail or remain incomplete on btnxpuart device
  2. Unload the btnxpuart driver module or trigger hci_dev_open_sync via power-on workqueue
  3. Kernel executes btnxpuart_flush without rx validation and calls kfree_skb_reason on null pointer
  4. System panics with NULL pointer dereference (ESR 0x96000004) and Oops in dmesg

How to detect it

Search kernel logs and dmesg for btnxpuart_flush, kfree_skb_reason, and the specific Oops trace containing ESR 0x96000004 or hci_power_on workqueue entries; correlate with module unload events.

  • btnxpuart_flush+0x40/0x58
  • Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080
  • ESR = 0x0000000096000004
  • Workqueue: hci0 hci_power_on
  • Modules linked in: btnxpuart

What your security team should do

  • Immediately identify and patch all systems running vulnerable Linux kernels with the btnxpuart driver
  • Monitor kernel logs for btnxpuart-related Oops and NULL pointer crashes as indicators of exposure
  • Restrict local user ability to unload Bluetooth modules until systems are updated
  • Test patched kernels in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() This adds a check before freeing the rx->skb in flush and close functions to handle the kernel crash seen while removing driver after FW download fails or before FW download completes. dmesg log: [ 54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080 [ 54.643398] Mem abort info: [ 54.646204] ESR = 0x0000000096000004 [ 54.649964] EC = 0x25: DABT (current EL), IL = 32 bits [ 54.655286] SET = 0, FnV = 0 [ 54.658348] EA = 0, S1PTW = 0 [ 54.661498] FSC = 0x04: level 0 translation fault [ 54.666391] Data abort info: [ 54.669273] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 54.674768] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 54.674771] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000 [ 54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000 [ 54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse [ 54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2 [ 54.744364] Hardware name: FSL i.MX8MM EVK board (DT) [ 54.744368] Workqueue: hci0 hci_power_on [ 54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 54.757249] pc : kfree_skb_reason+0x18/0xb0 [ 54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart] [ 54.782921] sp : ffff8000805ebca0 [ 54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000 [ 54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230 [ 54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92 [ 54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff [ 54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857 [ 54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642 [ 54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688 [ 54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000 [ 54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac [ 54.857599] Call trace: [ 54.857601] kfree_skb_reason+0x18/0xb0 [ 54.863878] btnxpuart_flush+0x40/0x58 [btnxpuart] [ 54.863888] hci_dev_open_sync+0x3a8/0xa04 [ 54.872773] hci_power_on+0x54/0x2e4 [ 54.881832] process_one_work+0x138/0x260 [ 54.881842] worker_thread+0x32c/0x438 [ 54.881847] kthread+0x118/0x11c [ 54.881853] ret_from_fork+0x10/0x20 [ 54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400) [ 54.896410] ---[ end trace 0000000000000000 ]---

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.10.11-1
Linux Kernel 6.4.0 6.6.51
Mageia:9 kernel 0 6.6.52-1.mga9
Mageia:9 kernel-linus 0 6.6.52-1.mga9
Mageia:9 kmod-virtualbox 0 7.0.20-54.mga9
Mageia:9 kmod-xtables-addons 0 3.24-62.mga9
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_4 0 1-150600.1.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_5 0 1-150600.13.3.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.25.1.150600.12.10.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco 0 6.4.0-15061.6.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco_debug 0 6.4.0-15061.6.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-source-coco 0 6.4.0-15061.6.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-syms-coco 0 6.4.0-15061.6.coco15sp6.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.25.2
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.25.2
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.25.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.14.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.14.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.14.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.25.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.14.1
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.14.1
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.14.1
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.14.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1020.22~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1020.23~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-50.51~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 No fix
Ubuntu:22.04:LTS linux-ibm-6.8 0 6.8.0-1017.17~22.04.1
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 No fix
Ubuntu:22.04:LTS linux-kvm 0 No fix
Ubuntu:22.04:LTS linux-lowlatency 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-nvidia-tegra 0 No fix
Ubuntu:22.04:LTS linux-nvidia-tegra-igx 0 No fix
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1017.18~22.04.1
Ubuntu:22.04:LTS linux-raspi 0 No fix
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 No fix
Ubuntu:24.04:LTS linux 0 6.8.0-50.51
Ubuntu:24.04:LTS linux-aws 0 6.8.0-1020.22
Ubuntu:24.04:LTS linux-azure 0 6.8.0-1020.23
Ubuntu:24.04:LTS linux-gcp 0 6.8.0-1019.21
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1015.19
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1002.4
Ubuntu:24.04:LTS linux-ibm 0 6.8.0-1017.17
Ubuntu:24.04:LTS linux-lowlatency 0 6.8.0-50.51.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1019.21
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1019.21.1
Ubuntu:24.04:LTS linux-oem-6.11 0 6.11.0-1007.7
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1018.18
Ubuntu:24.04:LTS linux-oracle 0 6.8.0-1017.18
Ubuntu:24.04:LTS linux-raspi 0 6.8.0-1016.18
Ubuntu:24.04:LTS linux-raspi-realtime 0 No fix
Ubuntu:24.04:LTS linux-realtime 0 No fix
Ubuntu:24.04:LTS linux-riscv 0 6.8.0-50.51.1
Ubuntu:24.04:LTS linux-xilinx 0 6.8.0-1017.18
Ubuntu:24.10 linux 0 6.11.0-7.7
Ubuntu:24.10 linux-aws 0 6.11.0-1002.2
Ubuntu:24.10 linux-azure 0 6.11.0-1003.3
Ubuntu:24.10 linux-gcp 0 6.11.0-1001.1
Ubuntu:24.10 linux-lowlatency 0 6.11.0-1002.2
Ubuntu:24.10 linux-oracle 0 6.11.0-1004.4
Ubuntu:24.10 linux-raspi 0 6.11.0-1003.3
Ubuntu:24.10 linux-realtime 0 6.11.0-1001.1
Ubuntu:24.10 linux-riscv 0 6.11.0-8.8.1
Ubuntu:Nvidia-BlueField:22.04:LTS linux-bluefield 0 No fix
Ubuntu:Pro:14.04:LTS linux 0 No fix
Ubuntu:Pro:14.04:LTS linux-aws 0 No fix
Ubuntu:Pro:14.04:LTS linux-azure 0 No fix
Ubuntu:Pro:14.04:LTS linux-lts-xenial 0 No fix
Ubuntu:Pro:16.04:LTS linux 0 No fix
Ubuntu:Pro:16.04:LTS linux-aws 0 No fix
Ubuntu:Pro:16.04:LTS linux-aws-hwe 0 No fix
Ubuntu:Pro:16.04:LTS linux-azure 0 No fix
Ubuntu:Pro:16.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:16.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:16.04:LTS linux-kvm 0 No fix

Related vulnerabilities