CVE-2024-56605

What it actually does

bt_sock_alloc attaches a newly allocated sk to the sock; on subsequent error l2cap_sock_alloc frees the sk while leaving the dangling pointer in the sock, enabling a later use-after-free when other kernel code dereferences it.

Why it matters to the business

Linux systems that use Bluetooth can experience kernel crashes or allow an attacker with local or Bluetooth-adjacent access to gain elevated privileges, disrupting operations and potentially leading to full system compromise on servers, desktops, or embedded devices.

How an attack unfolds

An attacker triggers l2cap_sock_create with parameters that cause an error path after bt_sock_alloc succeeds; the freed sk remains referenced by the sock structure, and subsequent socket operations or Bluetooth stack activity dereference the dangling pointer, leading to arbitrary kernel read/write or code execution. Observed Linux kernel privilege-escalation campaigns by espionage and financially motivated actors have targeted similar kernel UAF flaws.

How to fix it

Update the Linux kernel to the commit f6ad641646b67f29c7578dcd6c25813c7dcbf51e or later stable releases that contain the fix; rebuild and deploy the patched kernel on all affected systems; disable Bluetooth if not required as a temporary mitigation.

How to confirm the fix worked

Verify the running kernel contains commit f6ad641646b67f29c7578dcd6c25813c7dcbf51e by checking git log or kernel version strings; attempt to reproduce the original error path in a controlled test and confirm no dangling pointer remains; scan for the vulnerable l2cap_sock_create code pattern in the source tree.

Typical attack path

1. Obtain local shell or establish a malicious Bluetooth connection to the target
2. Invoke socket creation via l2cap_sock_create that forces the error path after allocation
3. Trigger reuse of the dangling sk pointer through normal Bluetooth or socket activity
4. Leverage the resulting UAF for kernel memory corruption and privilege escalation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for Bluetooth L2CAP socket allocation failures followed by use-after-free warnings or oops; inspect auditd or eBPF traces for unexpected l2cap_sock_create calls; correlate with threat intelligence on Linux kernel exploitation campaigns by espionage actors.

What your security team should do

• Immediately upgrade all Linux kernel packages to a version containing f6ad641646b67f29c7578dcd6c25813c7dcbf51e
• Prioritize patching on systems that expose Bluetooth interfaces or run untrusted local workloads
• Monitor for new Linux kernel privilege-escalation campaigns and apply updates within CISA-recommended timeframes where applicable
• Review and restrict Bluetooth usage via kernel configuration or runtime policies until patches are deployed