CVE-2024-35856 – This CVE describes a double-free vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-35856?

CVE-2024-35856 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's Bluetooth driver for MediaTek chipsets. When a Bluetooth device coredump fails, the kernel attempts to free the same memory buffer twice, which can lead to memory corruption and system instability. This affects Linux systems with MediaTek Bluetooth hardware and the vulnerable kernel driver.

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's Bluetooth driver for MediaTek chipsets. When a Bluetooth device coredump fails, the kernel attempts to free the same memory buffer twice, which can lead to memory corruption and system instability. This affects Linux systems with MediaTek Bluetooth hardware and the vulnerable kernel driver.

💻 Affected Systems

Products:

Linux kernel with MediaTek Bluetooth driver (btusb)

Versions: Linux kernel versions containing the vulnerable code (specific commit ranges in the stable branches referenced in the CVE)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with MediaTek Bluetooth hardware where the btusb driver is loaded and coredump functionality is triggered.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or potential privilege escalation if an attacker can trigger the double-free and control memory allocation patterns to execute arbitrary code.

🟠

Likely Case

System instability, kernel crashes, or denial of service when Bluetooth coredump operations fail under specific conditions.

🟢

If Mitigated

Minimal impact if Bluetooth coredump functionality is not used or if the system has memory corruption protections enabled.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the Bluetooth subsystem and cannot be exploited remotely over the internet.

🏢 Internal Only: MEDIUM - Requires local access to trigger Bluetooth coredump failures, but could be exploited by malicious local users or through adjacent network attacks on Bluetooth.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering specific error conditions in Bluetooth coredump handling and controlling memory allocation patterns.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 18bdb386a1a30e7a3d7732a98e45e69cf6b5710d, 80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1, e20093c741d8da9f6390dd45d75b779861547035

Vendor Advisory: https://git.kernel.org/stable/c/18bdb386a1a30e7a3d7732a98e45e69cf6b5710d

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Reboot system to load new kernel. 3. Verify the patch is applied by checking kernel version or commit hash.

🔧 Temporary Workarounds

Disable Bluetooth coredump functionality

linux

Prevent the vulnerable code path from being triggered by disabling Bluetooth coredump features

echo 0 > /sys/kernel/debug/bluetooth/hci*/coredump

Unload MediaTek Bluetooth driver

linux

Remove the vulnerable driver if Bluetooth is not needed

modprobe -r btusb

🧯 If You Can't Patch

Restrict Bluetooth access to trusted users only
Implement strict access controls and monitoring for Bluetooth-related system calls

🔍 How to Verify

Check if Vulnerable:

Check if system has MediaTek Bluetooth hardware and vulnerable kernel version: lspci | grep -i mediatek && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or check if the double-free code path has been removed

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Bluetooth subsystem crash logs
Memory corruption warnings in dmesg

Network Indicators:

Unusual Bluetooth connection attempts triggering coredump

SIEM Query:

source="kernel" AND ("double free" OR "panic" OR "Oops") AND "bluetooth"

📊 Metadata

CVE ID: CVE-2024-35856

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: May 17, 2024

Last Updated: December 30, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35856, you might also want to check these: