CVE-2024-57987
📋 TL;DR
A NULL pointer dereference vulnerability in the Linux kernel's Bluetooth subsystem allows kernel crashes when unsupported USB Bluetooth dongles are inserted. This affects Linux systems using the btrtl driver for Realtek Bluetooth chips. Attackers with physical access could cause denial of service by inserting malicious USB devices.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, requiring physical reboot.
Likely Case
System crash when unsupported Bluetooth dongle is inserted, requiring reboot to restore functionality.
If Mitigated
Minor disruption if system automatically recovers from kernel panic, but still requires physical intervention.
🎯 Exploit Status
Exploitation requires physical access to insert USB device. No authentication required once physical access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 02f9da874e5e, 1158ad8e8abb, or 3c15082f3567
Vendor Advisory: https://git.kernel.org/stable/c/02f9da874e5e4626f81772eacc18967921998a71
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable Bluetooth module loading
linuxPrevent btrtl module from loading to avoid vulnerability
echo 'blacklist btrtl' >> /etc/modprobe.d/blacklist-btrtl.conf
rmmod btrtl
Restrict USB device access
linuxUse udev rules to block unauthorized USB Bluetooth devices
echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="0bda", ATTR{idProduct}=="*", ATTR{authorized}="0"' > /etc/udev/rules.d/99-block-realtek-bluetooth.rules
udevadm control --reload-rules
🧯 If You Can't Patch
- Implement strict physical security controls to prevent unauthorized USB device insertion
- Disable Bluetooth functionality entirely if not required for system operation
🔍 How to Verify
Check if Vulnerable:
Check if btrtl module is loaded: lsmod | grep btrtlCheck Version:
uname -rVerify Fix Applied:
Check kernel version contains fix: uname -r and verify against patched versions📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- NULL pointer dereference errors mentioning btrtl_setup_realtek
Network Indicators:
- Sudden loss of Bluetooth connectivity
SIEM Query:
source="kern.log" AND "NULL pointer dereference" AND "btrtl"