CVE-2024-50077

What it actually does

Duplicate initialization of Bluetooth ISO protocol sockets occurs when debugfs creation fails, skipping the iso_inited flag and causing repeated proto_register, bt_sock_register, and list_add operations that trigger double-add BUGs under CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION.

Why it matters to the business

Kernel crashes or instability on affected older Ubuntu LTS releases during Bluetooth ISO operations can lead to system downtime and service disruption, with high ecosystem prevalence across many downstream kernel packages.

How an attack unfolds

An attacker triggers repeated iso_init calls via Bluetooth socket operations such as hci_sock_sendmsg; because the early return leaves iso_inited false, duplicate registrations execute and corrupt kernel lists, causing an immediate BUG and oops on hardened configurations. Threat actors in 2024 zero-day campaigns have targeted similar Linux kernel resource issues.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-70.113 (Ubuntu 14.04 LTS), linux-aws 4.4.0-1002.2 (Ubuntu 14.04 LTS), linux 4.2.0-16.19 (Ubuntu 16.04 LTS), linux-hwe 4.8.0-36.36~16.04.1 (Ubuntu 16.04 LTS) and equivalent per-package fixes; disable unnecessary Bluetooth ISO support where possible until patched.

How to confirm the fix worked

Confirm running kernel versions match or exceed the fixed releases above, verify absence of early-return logic in iso_init, and test repeated Bluetooth ISO socket creation under disabled debugfs without triggering list-debug BUGs.

Typical attack path

1. Establish Bluetooth connection or send HCI messages to invoke set_iso_socket_func
2. Force multiple entries into iso_init when bt_debugfs creation failed
3. Execute duplicate proto_register and list_add calls
4. Trigger list corruption BUG under hardened configs resulting in kernel panic

How to detect it

Search kernel logs and dmesg for Bluetooth module stack traces containing list_add double add, __list_add_valid_or_report, proto_register, iso_init, and hci_sock_sendmsg; correlate with bluetoothd process activity and CONFIG_BUG_ON_DATA_CORRUPTION panics.

• list_add double add: new=ffffffffc0b280d0, prev=ffffffffbab56250
• kernel BUG at lib/list_debug.c:35
• iso_init+0x23/0x150 [bluetooth]
• proto_register+0x2b5/0x340
• __list_add_valid_or_report+0x9a/0xa0

What your security team should do

• Prioritize immediate kernel upgrades on all exposed Ubuntu 14.04/16.04 systems given high downstream prevalence
• Enable kernel crash logging and monitor for Bluetooth-related oops
• Restrict Bluetooth ISO socket usage until patches are deployed
• Review CONFIG_DEBUG_FS settings and consider enabling hardened list checks