CVE-2024-56653 (GCVE-0-2024-56653)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:45
VLAI
Title
Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump hci_devcd_append may lead to the release of the skb, so it cannot be accessed once it is called. ================================================================== BUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk] Read of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82 CPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G U 6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c Hardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024 Workqueue: events btusb_rx_work [btusb] Call Trace: <TASK> dump_stack_lvl+0xfd/0x150 print_report+0x131/0x780 kasan_report+0x177/0x1c0 btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01] btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 82: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 __kasan_slab_alloc+0x4e/0x60 kmem_cache_alloc+0x19f/0x360 skb_clone+0x132/0xf70 btusb_recv_acl_mtk+0x104/0x1a0 [btusb] btusb_rx_work+0x9e/0xe0 [btusb] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 Freed by task 1733: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 kasan_save_free_info+0x28/0xb0 ____kasan_slab_free+0xfd/0x170 kmem_cache_free+0x183/0x3f0 hci_devcd_rx+0x91a/0x2060 [bluetooth] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 The buggy address belongs to the object at ffff888033cfab40 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 112 bytes inside of freed 232-byte region [ffff888033cfab40, ffff888033cfac28) The buggy address belongs to the physical page: page:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa head:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x4000000000000840(slab|head|zone=1) page_type: 0xffffffff() raw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Check if we need to call hci_devcd_complete before calling hci_devcd_append. That requires that we check data->cd_info.cnt >= MTK_COREDUMP_NUM instead of data->cd_info.cnt > MTK_COREDUMP_NUM, as we increment data->cd_info.cnt only once the call to hci_devcd_append succeeds.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-10 17:12 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0b70151328781a89c89e4cf3fae21fc0e98d869e , < ecdcaea0e4057171ea4c3783e1cc1c900ad99125 (git)
Affected: 0b70151328781a89c89e4cf3fae21fc0e98d869e , < d20ff1d3cb40479789368f502eedb0a00e4161fc (git)
Affected: 0b70151328781a89c89e4cf3fae21fc0e98d869e , < b548f5e9456c568155499d9ebac675c0d7a296e8 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.67 , ≤ 6.6.* (semver)
Unaffected: 6.12.6 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:12:36.149628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T17:21:07.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btmtk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ecdcaea0e4057171ea4c3783e1cc1c900ad99125",
              "status": "affected",
              "version": "0b70151328781a89c89e4cf3fae21fc0e98d869e",
              "versionType": "git"
            },
            {
              "lessThan": "d20ff1d3cb40479789368f502eedb0a00e4161fc",
              "status": "affected",
              "version": "0b70151328781a89c89e4cf3fae21fc0e98d869e",
              "versionType": "git"
            },
            {
              "lessThan": "b548f5e9456c568155499d9ebac675c0d7a296e8",
              "status": "affected",
              "version": "0b70151328781a89c89e4cf3fae21fc0e98d869e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btmtk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.67",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: avoid UAF in btmtk_process_coredump\n\nhci_devcd_append may lead to the release of the skb, so it cannot be\naccessed once it is called.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk]\nRead of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82\n\nCPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G     U             6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c\nHardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024\nWorkqueue: events btusb_rx_work [btusb]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xfd/0x150\n print_report+0x131/0x780\n kasan_report+0x177/0x1c0\n btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01]\n btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\n btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e\n\nAllocated by task 82:\n stack_trace_save+0xdc/0x190\n kasan_set_track+0x4e/0x80\n __kasan_slab_alloc+0x4e/0x60\n kmem_cache_alloc+0x19f/0x360\n skb_clone+0x132/0xf70\n btusb_recv_acl_mtk+0x104/0x1a0 [btusb]\n btusb_rx_work+0x9e/0xe0 [btusb]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n\nFreed by task 1733:\n stack_trace_save+0xdc/0x190\n kasan_set_track+0x4e/0x80\n kasan_save_free_info+0x28/0xb0\n ____kasan_slab_free+0xfd/0x170\n kmem_cache_free+0x183/0x3f0\n hci_devcd_rx+0x91a/0x2060 [bluetooth]\n worker_thread+0xe44/0x2cc0\n kthread+0x2ff/0x3a0\n ret_from_fork+0x51/0x80\n ret_from_fork_asm+0x1b/0x30\n\nThe buggy address belongs to the object at ffff888033cfab40\n which belongs to the cache skbuff_head_cache of size 232\nThe buggy address is located 112 bytes inside of\n freed 232-byte region [ffff888033cfab40, ffff888033cfac28)\n\nThe buggy address belongs to the physical page:\npage:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa\nhead:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0x4000000000000840(slab|head|zone=1)\npage_type: 0xffffffff()\nraw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001\nraw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\n ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n\u003effff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                     ^\n ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc\n ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nCheck if we need to call hci_devcd_complete before calling\nhci_devcd_append. That requires that we check data-\u003ecd_info.cnt \u003e=\nMTK_COREDUMP_NUM instead of data-\u003ecd_info.cnt \u003e MTK_COREDUMP_NUM, as we\nincrement data-\u003ecd_info.cnt only once the call to hci_devcd_append\nsucceeds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is the Bluetooth controller receive path (`btmtk_usb_recv_acl` \u2192 `btmtk_process_coredump`), entered when the MediaTek BT firmware crashes and streams coredump ACL packets; a Bluetooth-range attacker can induce firmware asserts over the air and influence the dump packet stream, matching the Adjacent classification used for Bluetooth/devcoredump issues (CVE-2025-38592, CVE-2025-37918).\nAC:L - `hci_devcd_append()` queues the skb to another workqueue that frees it, so the UAF window opens on every appended packet once `cnt \u003e 255`, and a single ~1 MB coredump produces hundreds of such packets \u2014 the attacker gets many free attempts and can repeat the trigger, so no condition outside their control is required.\nPR:N - No privilege check, capability test, or authentication exists anywhere on the path \u2014 the code runs unconditionally from the driver\u0027s rx workqueue on data received from the controller, with no userspace involvement at all.\nUI:N - The coredump path is driven entirely by controller-emitted firmware dump packets processed asynchronously in a kernel workqueue; no victim action is needed.\nS:U - The use-after-free corrupts kernel heap state and is exploited within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Both `skb-\u003elen` and the `skb-\u003edata` pointer are read from the freed `skbuff_head_cache` object and then used as the address of a 12-byte `memcmp`, so an attacker who sprays the readily-reusable skb slab obtains a controlled arbitrary-address read whose outcome is observable via whether a devcoredump is emitted to userspace.\nI:H - A use-after-free on a heavily reused slab cache is a heap-grooming primitive: the stale object drives control flow (`hci_devcd_complete()` and the coredump state machine) from attacker-groomed memory, and per standard kernel UAF treatment this is exploitable for memory corruption.\nA:H - The freed `skb-\u003edata`/`skb-\u003elen` pair produces a wild-pointer dereference in `memcmp`, causing a kernel oops/panic (confirmed by the KASAN slab-use-after-free report), and the condition recurs for every dump packet."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:50.987Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ecdcaea0e4057171ea4c3783e1cc1c900ad99125"
        },
        {
          "url": "https://git.kernel.org/stable/c/d20ff1d3cb40479789368f502eedb0a00e4161fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b548f5e9456c568155499d9ebac675c0d7a296e8"
        }
      ],
      "title": "Bluetooth: btmtk: avoid UAF in btmtk_process_coredump",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56653",
    "datePublished": "2024-12-27T15:06:17.267Z",
    "dateReserved": "2024-12-27T15:00:39.841Z",
    "dateUpdated": "2026-08-05T11:45:50.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56653",
      "date": "2026-08-15",
      "epss": "0.0031",
      "percentile": "0.23685"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6\", \"versionEndExcluding\": \"6.6.67\", \"matchCriteriaId\": \"C2B02EC6-8145-43B2-B9EE-8A4FB1DE530C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.12.6\", \"matchCriteriaId\": \"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btmtk: avoid UAF in btmtk_process_coredump\\n\\nhci_devcd_append may lead to the release of the skb, so it cannot be\\naccessed once it is called.\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk]\\nRead of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82\\n\\nCPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G     U             6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c\\nHardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024\\nWorkqueue: events btusb_rx_work [btusb]\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0xfd/0x150\\n print_report+0x131/0x780\\n kasan_report+0x177/0x1c0\\n btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01]\\n btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\\n btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 82:\\n stack_trace_save+0xdc/0x190\\n kasan_set_track+0x4e/0x80\\n __kasan_slab_alloc+0x4e/0x60\\n kmem_cache_alloc+0x19f/0x360\\n skb_clone+0x132/0xf70\\n btusb_recv_acl_mtk+0x104/0x1a0 [btusb]\\n btusb_rx_work+0x9e/0xe0 [btusb]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n\\nFreed by task 1733:\\n stack_trace_save+0xdc/0x190\\n kasan_set_track+0x4e/0x80\\n kasan_save_free_info+0x28/0xb0\\n ____kasan_slab_free+0xfd/0x170\\n kmem_cache_free+0x183/0x3f0\\n hci_devcd_rx+0x91a/0x2060 [bluetooth]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n\\nThe buggy address belongs to the object at ffff888033cfab40\\n which belongs to the cache skbuff_head_cache of size 232\\nThe buggy address is located 112 bytes inside of\\n freed 232-byte region [ffff888033cfab40, ffff888033cfac28)\\n\\nThe buggy address belongs to the physical page:\\npage:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa\\nhead:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\nanon flags: 0x4000000000000840(slab|head|zone=1)\\npage_type: 0xffffffff()\\nraw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001\\nraw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\n\\nMemory state around the buggy address:\\n ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\\n ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\\n\u003effff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n                                     ^\\n ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc\\n ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n==================================================================\\n\\nCheck if we need to call hci_devcd_complete before calling\\nhci_devcd_append. That requires that we check data-\u003ecd_info.cnt \u003e=\\nMTK_COREDUMP_NUM instead of data-\u003ecd_info.cnt \u003e MTK_COREDUMP_NUM, as we\\nincrement data-\u003ecd_info.cnt only once the call to hci_devcd_append\\nsucceeds.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btmtk: evitar UAF en btmtk_process_coredump hci_devcd_append puede provocar la liberaci\\u00f3n del skb, por lo que no se puede acceder a \\u00e9l una vez que se llama. ===================================================================== ERROR: KASAN: slab-use-after-free en btmtk_process_coredump+0x2a7/0x2d0 [btmtk] Lectura de tama\\u00f1o 4 en la direcci\\u00f3n ffff888033cfabb0 por la tarea kworker/0:3/82 CPU: 0 PID: 82 Comm: kworker/0:3 Contaminado: GU 6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c Nombre del hardware: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 07/05/2024 Cola de trabajo: eventos btusb_rx_work [btusb] Seguimiento de llamadas:  dump_stack_lvl+0xfd/0x150 print_report+0x131/0x780 kasan_report+0x177/0x1c0 btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01] btusb_recv_acl_mtk+0x11c/0x1a0 [btusb Asignado por la tarea 82: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 __kasan_slab_alloc+0x4e/0x60 kmem_cache_alloc+0x19f/0x360 skb_clone+0x132/0xf70 btusb_recv_acl_mtk+0x104/0x1a0 [btusb] btusb_rx_work+0x9e/0xe0 [btusb] subproceso de trabajo+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 Liberado por la tarea 1733: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 kasan_save_free_info+0x28/0xb0 ____kasan_slab_free+0xfd/0x170 kmem_cache_free+0x183/0x3f0 hci_devcd_rx+0x91a/0x2060 [bluetooth] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 La direcci\\u00f3n con errores pertenece al objeto en ffff888033cfab40 que pertenece al cach\\u00e9 skbuff_head_cache de tama\\u00f1o 232 La direcci\\u00f3n con errores se encuentra 112 bytes dentro de la regi\\u00f3n liberada de 232 bytes [ffff888033cfab40, ffff888033cfac28) La direcci\\u00f3n con errores pertenece a la p\\u00e1gina f\\u00edsica: page:00000000a174ba93 refcount:1 mapcount:0 mapeo:0000000000000000 \\u00edndice:0x0 pfn:0x33cfa encabezado:00000000a174ba93 orden:1 recuento_de_mapas_entero:0 nr_p\\u00e1ginas_asignadas:0 recuento_de_pins:0 anon banderas: 0x4000000000000840(slab|head|zone=1) tipo_de_p\\u00e1gina: 0xffffffff() sin procesar: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001 sin procesar: 000000000000000 000000000080190019 00000001ffffffff 0000000000000000 p\\u00e1gina volcada porque: kasan: se detect\\u00f3 un acceso incorrecto Estado de la memoria alrededor de la direcci\\u00f3n con errores: ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888033cfab00: fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb \u0026gt;ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888033cfac00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb == ...\"}]",
      "id": "CVE-2024-56653",
      "lastModified": "2025-01-06T22:33:30.837",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-12-27T15:15:25.133",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/b548f5e9456c568155499d9ebac675c0d7a296e8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d20ff1d3cb40479789368f502eedb0a00e4161fc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ecdcaea0e4057171ea4c3783e1cc1c900ad99125\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:43:11.000Z",
      "cve": "CVE-2024-56653",
      "id": "msrc_CVE-2024-56653",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: btmtk: avoid UAF in btmtk_process_coredump",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56653.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56653\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:25.133\",\"lastModified\":\"2026-08-04T11:22:17.997\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btmtk: avoid UAF in btmtk_process_coredump\\n\\nhci_devcd_append may lead to the release of the skb, so it cannot be\\naccessed once it is called.\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk]\\nRead of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82\\n\\nCPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G     U             6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c\\nHardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024\\nWorkqueue: events btusb_rx_work [btusb]\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0xfd/0x150\\n print_report+0x131/0x780\\n kasan_report+0x177/0x1c0\\n btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01]\\n btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\\n btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 82:\\n stack_trace_save+0xdc/0x190\\n kasan_set_track+0x4e/0x80\\n __kasan_slab_alloc+0x4e/0x60\\n kmem_cache_alloc+0x19f/0x360\\n skb_clone+0x132/0xf70\\n btusb_recv_acl_mtk+0x104/0x1a0 [btusb]\\n btusb_rx_work+0x9e/0xe0 [btusb]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n\\nFreed by task 1733:\\n stack_trace_save+0xdc/0x190\\n kasan_set_track+0x4e/0x80\\n kasan_save_free_info+0x28/0xb0\\n ____kasan_slab_free+0xfd/0x170\\n kmem_cache_free+0x183/0x3f0\\n hci_devcd_rx+0x91a/0x2060 [bluetooth]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n\\nThe buggy address belongs to the object at ffff888033cfab40\\n which belongs to the cache skbuff_head_cache of size 232\\nThe buggy address is located 112 bytes inside of\\n freed 232-byte region [ffff888033cfab40, ffff888033cfac28)\\n\\nThe buggy address belongs to the physical page:\\npage:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa\\nhead:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\nanon flags: 0x4000000000000840(slab|head|zone=1)\\npage_type: 0xffffffff()\\nraw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001\\nraw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\n\\nMemory state around the buggy address:\\n ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\\n ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\\n\u003effff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n                                     ^\\n ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc\\n ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n==================================================================\\n\\nCheck if we need to call hci_devcd_complete before calling\\nhci_devcd_append. That requires that we check data-\u003ecd_info.cnt \u003e=\\nMTK_COREDUMP_NUM instead of data-\u003ecd_info.cnt \u003e MTK_COREDUMP_NUM, as we\\nincrement data-\u003ecd_info.cnt only once the call to hci_devcd_append\\nsucceeds.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btmtk: evitar UAF en btmtk_process_coredump hci_devcd_append puede provocar la liberaci\u00f3n del skb, por lo que no se puede acceder a \u00e9l una vez que se llama. ===================================================================== ERROR: KASAN: slab-use-after-free en btmtk_process_coredump+0x2a7/0x2d0 [btmtk] Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff888033cfabb0 por la tarea kworker/0:3/82 CPU: 0 PID: 82 Comm: kworker/0:3 Contaminado: GU 6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c Nombre del hardware: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 07/05/2024 Cola de trabajo: eventos btusb_rx_work [btusb] Seguimiento de llamadas:  dump_stack_lvl+0xfd/0x150 print_report+0x131/0x780 kasan_report+0x177/0x1c0 btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01] btusb_recv_acl_mtk+0x11c/0x1a0 [btusb Asignado por la tarea 82: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 __kasan_slab_alloc+0x4e/0x60 kmem_cache_alloc+0x19f/0x360 skb_clone+0x132/0xf70 btusb_recv_acl_mtk+0x104/0x1a0 [btusb] btusb_rx_work+0x9e/0xe0 [btusb] subproceso de trabajo+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 Liberado por la tarea 1733: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 kasan_save_free_info+0x28/0xb0 ____kasan_slab_free+0xfd/0x170 kmem_cache_free+0x183/0x3f0 hci_devcd_rx+0x91a/0x2060 [bluetooth] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 La direcci\u00f3n con errores pertenece al objeto en ffff888033cfab40 que pertenece al cach\u00e9 skbuff_head_cache de tama\u00f1o 232 La direcci\u00f3n con errores se encuentra 112 bytes dentro de la regi\u00f3n liberada de 232 bytes [ffff888033cfab40, ffff888033cfac28) La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: page:00000000a174ba93 refcount:1 mapcount:0 mapeo:0000000000000000 \u00edndice:0x0 pfn:0x33cfa encabezado:00000000a174ba93 orden:1 recuento_de_mapas_entero:0 nr_p\u00e1ginas_asignadas:0 recuento_de_pins:0 anon banderas: 0x4000000000000840(slab|head|zone=1) tipo_de_p\u00e1gina: 0xffffffff() sin procesar: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001 sin procesar: 000000000000000 000000000080190019 00000001ffffffff 0000000000000000 p\u00e1gina volcada porque: kasan: se detect\u00f3 un acceso incorrecto Estado de la memoria alrededor de la direcci\u00f3n con errores: ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888033cfab00: fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb \u0026gt;ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888033cfac00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb == ...\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/bluetooth/btmtk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0b70151328781a89c89e4cf3fae21fc0e98d869e\",\"lessThan\":\"ecdcaea0e4057171ea4c3783e1cc1c900ad99125\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b70151328781a89c89e4cf3fae21fc0e98d869e\",\"lessThan\":\"d20ff1d3cb40479789368f502eedb0a00e4161fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b70151328781a89c89e4cf3fae21fc0e98d869e\",\"lessThan\":\"b548f5e9456c568155499d9ebac675c0d7a296e8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/bluetooth/btmtk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.67\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.6\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-10T17:12:36.149628Z\",\"id\":\"CVE-2024-56653\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.67\",\"matchCriteriaId\":\"C2B02EC6-8145-43B2-B9EE-8A4FB1DE530C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b548f5e9456c568155499d9ebac675c0d7a296e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d20ff1d3cb40479789368f502eedb0a00e4161fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ecdcaea0e4057171ea4c3783e1cc1c900ad99125\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:56+00:00",
      "cve": "CVE-2024-56653",
      "id": "CVE-2024-56653",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56653.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:49:08Z",
      "cve": "CVE-2024-56653",
      "id": "CVE-2024-56653",
      "initial_release_date": "2025-01-10T00:21:32Z",
      "product_status:known_not_affected": "425",
      "product_status:recommended": "155",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56653",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56653.json",
      "version": "23"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56653\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-10T17:12:36.149628Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-10T17:12:37.549Z\"}}], \"cna\": {\"title\": \"Bluetooth: btmtk: avoid UAF in btmtk_process_coredump\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable code is the Bluetooth controller receive path (`btmtk_usb_recv_acl` \\u2192 `btmtk_process_coredump`), entered when the MediaTek BT firmware crashes and streams coredump ACL packets; a Bluetooth-range attacker can induce firmware asserts over the air and influence the dump packet stream, matching the Adjacent classification used for Bluetooth/devcoredump issues (CVE-2025-38592, CVE-2025-37918).\\nAC:L - `hci_devcd_append()` queues the skb to another workqueue that frees it, so the UAF window opens on every appended packet once `cnt \u003e 255`, and a single ~1 MB coredump produces hundreds of such packets \\u2014 the attacker gets many free attempts and can repeat the trigger, so no condition outside their control is required.\\nPR:N - No privilege check, capability test, or authentication exists anywhere on the path \\u2014 the code runs unconditionally from the driver\u0027s rx workqueue on data received from the controller, with no userspace involvement at all.\\nUI:N - The coredump path is driven entirely by controller-emitted firmware dump packets processed asynchronously in a kernel workqueue; no victim action is needed.\\nS:U - The use-after-free corrupts kernel heap state and is exploited within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - Both `skb-\u003elen` and the `skb-\u003edata` pointer are read from the freed `skbuff_head_cache` object and then used as the address of a 12-byte `memcmp`, so an attacker who sprays the readily-reusable skb slab obtains a controlled arbitrary-address read whose outcome is observable via whether a devcoredump is emitted to userspace.\\nI:H - A use-after-free on a heavily reused slab cache is a heap-grooming primitive: the stale object drives control flow (`hci_devcd_complete()` and the coredump state machine) from attacker-groomed memory, and per standard kernel UAF treatment this is exploitable for memory corruption.\\nA:H - The freed `skb-\u003edata`/`skb-\u003elen` pair produces a wild-pointer dereference in `memcmp`, causing a kernel oops/panic (confirmed by the KASAN slab-use-after-free report), and the condition recurs for every dump packet.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0b70151328781a89c89e4cf3fae21fc0e98d869e\", \"lessThan\": \"ecdcaea0e4057171ea4c3783e1cc1c900ad99125\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0b70151328781a89c89e4cf3fae21fc0e98d869e\", \"lessThan\": \"d20ff1d3cb40479789368f502eedb0a00e4161fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0b70151328781a89c89e4cf3fae21fc0e98d869e\", \"lessThan\": \"b548f5e9456c568155499d9ebac675c0d7a296e8\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/bluetooth/btmtk.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.67\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/bluetooth/btmtk.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ecdcaea0e4057171ea4c3783e1cc1c900ad99125\"}, {\"url\": \"https://git.kernel.org/stable/c/d20ff1d3cb40479789368f502eedb0a00e4161fc\"}, {\"url\": \"https://git.kernel.org/stable/c/b548f5e9456c568155499d9ebac675c0d7a296e8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: btmtk: avoid UAF in btmtk_process_coredump\\n\\nhci_devcd_append may lead to the release of the skb, so it cannot be\\naccessed once it is called.\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk]\\nRead of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82\\n\\nCPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G     U             6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c\\nHardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024\\nWorkqueue: events btusb_rx_work [btusb]\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0xfd/0x150\\n print_report+0x131/0x780\\n kasan_report+0x177/0x1c0\\n btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01]\\n btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\\n btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 82:\\n stack_trace_save+0xdc/0x190\\n kasan_set_track+0x4e/0x80\\n __kasan_slab_alloc+0x4e/0x60\\n kmem_cache_alloc+0x19f/0x360\\n skb_clone+0x132/0xf70\\n btusb_recv_acl_mtk+0x104/0x1a0 [btusb]\\n btusb_rx_work+0x9e/0xe0 [btusb]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n\\nFreed by task 1733:\\n stack_trace_save+0xdc/0x190\\n kasan_set_track+0x4e/0x80\\n kasan_save_free_info+0x28/0xb0\\n ____kasan_slab_free+0xfd/0x170\\n kmem_cache_free+0x183/0x3f0\\n hci_devcd_rx+0x91a/0x2060 [bluetooth]\\n worker_thread+0xe44/0x2cc0\\n kthread+0x2ff/0x3a0\\n ret_from_fork+0x51/0x80\\n ret_from_fork_asm+0x1b/0x30\\n\\nThe buggy address belongs to the object at ffff888033cfab40\\n which belongs to the cache skbuff_head_cache of size 232\\nThe buggy address is located 112 bytes inside of\\n freed 232-byte region [ffff888033cfab40, ffff888033cfac28)\\n\\nThe buggy address belongs to the physical page:\\npage:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa\\nhead:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\nanon flags: 0x4000000000000840(slab|head|zone=1)\\npage_type: 0xffffffff()\\nraw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001\\nraw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\n\\nMemory state around the buggy address:\\n ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\\n ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\\n\u003effff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n                                     ^\\n ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc\\n ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\\n==================================================================\\n\\nCheck if we need to call hci_devcd_complete before calling\\nhci_devcd_append. That requires that we check data-\u003ecd_info.cnt \u003e=\\nMTK_COREDUMP_NUM instead of data-\u003ecd_info.cnt \u003e MTK_COREDUMP_NUM, as we\\nincrement data-\u003ecd_info.cnt only once the call to hci_devcd_append\\nsucceeds.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.67\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.6\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:50.987Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56653\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:50.987Z\", \"dateReserved\": \"2024-12-27T15:00:39.841Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:06:17.267Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.