製品・ソフトウェアに関する情報

JVN脆弱性詳細

Debian等の複数ベンダの製品における解放済みメモリの使用に関する脆弱性

Title	Debian等の複数ベンダの製品における解放済みメモリの使用に関する脆弱性
Summary	Linuxカーネルにおいて、以下の脆弱性が修正されました。Bluetoothにおけるsco_sock_timeoutによって引き起こされるuse-after-freeのバグを修正しました。sco接続が確立された後、scoソケットが解放されるとtimeout_workがスケジュールされ、scoの切断がタイムアウトかどうかを判断します。ソケットは後で解放されますが、sco_sock_timeout内で再び参照されます。その結果、use-after-freeのバグが発生します。根本的な原因は、CleanupスレッドとWorkerスレッド間での操作により、sco_sock_release - sco_sock_close - __sco_sock_close - sco_sock_set_timer - schedule_delayed_work、そしてsco_sock_killでsock_put(sk)が実行されメモリが解放される一方、Workerスレッドのsco_sock_timeoutでsock_hold(sk)が使用されることにあります。POCによってトリガーされたKASANレポートには、sco_sock_timeoutでのslab-use-after-freeの詳細なスタックトレースが示されています。解放済みの1024バイト領域の内部128バイトのアドレスに4バイトの書き込みが行われたことも報告されました。これにより、BluetoothのSCOソケットに関連するメモリ解放後の不正なアクセスによる脆弱性が判明し、今回修正されました。
Possible impacts	当該ソフトウェアが扱う全ての情報が外部に漏れる可能性があります。また、当該ソフトウェアが扱う全ての情報が書き換えられる可能性があります。さらに、当該ソフトウェアが完全に停止する可能性があります。そして、この脆弱性を悪用した攻撃の影響は、他のソフトウェアには及びません。
Solution	正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 14, 2024, midnight
Registration Date	Jan. 27, 2026, 5:38 p.m.
Last Update	Jan. 27, 2026, 5:38 p.m.

CVSS3.0 : 重要
Score	7.8
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected System

Debian

Debian GNU/Linux 10.0

Fedora Project

Fedora 39

Fedora 40

Linux

Linux Kernel 4.14.263 以上 4.15 未満

Linux Kernel 4.19.207 以上 4.19.314 未満

Linux Kernel 5.10.67 以上 5.10.217 未満

Linux Kernel 5.13.19 以上 5.14 未満

Linux Kernel 5.14.6 以上 5.15.159 未満

Linux Kernel 5.16 以上 6.1.91 未満

Linux Kernel 5.4.148 以上 5.4.276 未満

Linux Kernel 6.2 以上 6.6.31 未満

Linux Kernel 6.7 以上 6.8.10 未満

Linux Kernel 6.9

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2024-27398	https://www.cve.org/CVERecord?id=CVE-2024-27398
National Vulnerability Database (NVD)
2	CVE-2024-27398	https://nvd.nist.gov/vuln/detail/CVE-2024-27398

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-416	https://cwe.mitre.org/data/definitions/416.html

ベンダー情報

No	Name	URL
Debian Mailing Lists
1	[SECURITY] [DLA 3840-1] linux security update	https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
2	[SECURITY] [DLA 3843-1] linux-5.10 security update	https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
Fedora mailing-lists
3	[SECURITY] Fedora 39 Update: kernel-6.8.10-200.fc39 - package-announce - Fedora mailing-lists	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/
4	[SECURITY] Fedora 40 Update: kernel-6.8.10-300.fc40 - package-announce - Fedora mailing-lists	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/
NetApp Advisory
5	NetApp Product Security	https://security.netapp.com/advisory/ntap-20240912-0012/

その他

No	Name	URL
関連文書
1	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2)	https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2
2	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249)	https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249
3	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014)	https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014
4	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53)	https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53
5	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546)	https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546
6	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178)	https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178
7	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5)	https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5
8	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout - kernel/git/stable/linux.git - Linux kernel stable tree (https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93)	https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93
9	oss-security - Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect()	http://www.openwall.com/lists/oss-security/2024/11/29/1
10	oss-security - Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (http://www.openwall.com/lists/oss-security/2024/11/30/1)	http://www.openwall.com/lists/oss-security/2024/11/30/1
11	oss-security - Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (http://www.openwall.com/lists/oss-security/2024/11/30/2)	http://www.openwall.com/lists/oss-security/2024/11/30/2

Change Log

No	Changed Details	Date of change
1	[2026年01月27日] 掲載	Jan. 27, 2026, 5:38 p.m.

NVD Vulnerability Information

CVE-2024-27398

Summary	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread \| Worker Thread sco_sock_release \| sco_sock_close \| __sco_sock_close \| sco_sock_set_timer \| schedule_delayed_work \| sco_sock_kill \| (wait a time) sock_put(sk) //FREE \| sco_sock_timeout \| sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] ano ---truncated---
Publication Date	May 15, 2024, 12:12 a.m.
Registration Date	May 15, 2024, 10:05 a.m.
Last Update	Nov. 21, 2024, 6:04 p.m.

Related information, measures and tools

No	URL	refsource	タグ
1	https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2
2	https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2
3	https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249
4	https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249
5	https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014
6	https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014
7	https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53
8	https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53
9	https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546
10	https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546
11	https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178
12	https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178
13	https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5
14	https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5
15	https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93
16	https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93
17	https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
18	https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
19	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/
20	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/
21	https://security.netapp.com/advisory/ntap-20240912-0012/

Common Vulnerabilities List