CVE-2024-50044

What it actually does

The flaw creates a potential circular locking dependency between sk_lock and a device lock in the RFCOMM socket layer when rfcomm_sock_ioctl and rfcomm_sk_state_change interact, allowing a local deadlock under concurrent Bluetooth operations.

Why it matters to the business

Systems relying on Bluetooth RFCOMM may experience hangs or unresponsiveness in kernel threads, leading to service disruption for wireless device communication without broader system compromise.

How an attack unfolds

A local attacker with access to Bluetooth RFCOMM sockets invokes rfcomm_sock_ioctl while another path triggers rfcomm_sk_state_change, acquiring locks in an order that conflicts with the existing device lock held during DLC close operations, resulting in deadlock; no remote or unauthenticated exploitation is possible.

How to fix it

Update the Linux kernel to a version containing commit b77b3fb12fd483cae7c28648903b1d8a6b275f01 or later; apply the stable kernel update for the affected distribution and reboot.

How to confirm the fix worked

Verify the running kernel includes commit b77b3fb12fd483cae7c28648903b1d8a6b275f01 via git log or package version checks; confirm absence of the circular lock warning in dmesg under load testing of RFCOMM sockets.

Typical attack path

1. Obtain local user privileges on a system with Bluetooth RFCOMM enabled
2. Open and manipulate RFCOMM sockets via ioctl calls
3. Trigger concurrent socket state changes and DLC close paths through crafted Bluetooth operations
4. Induce the lock inversion to deadlock kernel threads handling the sockets

How to detect it

Review kernel logs for lockdep warnings mentioning sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM and rfcomm_sk_state_change; inspect audit logs for unusual local Bluetooth socket activity preceding hangs.

What your security team should do

• Prioritize kernel updates on systems with Bluetooth enabled within standard patch cycles
• Disable RFCOMM or Bluetooth if not required to reduce attack surface
• Monitor for kernel lockdep warnings related to rfcomm in production logs