Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Bluetoothl2cap修复 l2cap_chan_timeout 中的 null-ptr-deref l2cap_chan_timeout() 和 l2cap_chan_del() 之间存在争用条件。使用 l2cap_chan_del() 删除通道时chan->conn 将设置为 null。但 conn 可在 l2cap_chan_timeout() 的 mutex_lock() 中再次取消引用。因此将发生空指针取消引用缺陷。POC 触发的 KASAN 报告如下所示[ 472.074580] ==================================== ============================== [472.075284] BUGKASANmutex_lock+0x68/0xc0 中的 null-ptr-deref 472.075308] 通过任务 kworker/ 在地址 0000000000000158 写入大小 80:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 未受感染 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] 硬件名称QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] 工作队列事件 l2cap_chan_timeout [472.075308] 调用跟踪[ 472.075308<TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ========================== ======================================== [472.094860] 由于内核禁用锁定调试感染 [ 472.096136] 缺陷内核空指针取消引用地址 0000000000000158 [ 472.096136] #PF内核模式下的主管写入访问 [472.096136] #PFerror_code (0x0002) - 不存在页面 [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: GB 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] 硬件名称QEMU Standard PC(i440FX + PIIX,1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueueevents l2cap_chan_timeout [472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Codebe 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS
    00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08:
    ffff88800744fc7f R091ffff11000e89f8f [ 472.096136] R10dffffc0000000000 R11ffffed1000e89f90 R12
    dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS:
    0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeo ---truncated--- (CVE-2024-27399)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2024-27399

medium Nessus 插件 ID 228181

版本 1.18