CVE-2024-36012: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36012 is a slab-use-after-free vulnerability discovered in the Linux kernel's Bluetooth msft subsystem, specifically in the msft_do_close() function. The vulnerability was disclosed on May 23, 2024, affecting Linux kernel versions from 5.12 up to versions before 6.1.91, 6.2 to before 6.6.31, and 6.7 to before 6.8.10 (NVD).

The vulnerability occurs due to improper lifetime management of msft->data in relation to the hdev (host device) structure. The issue manifests when msft_do_close() attempts to access the filter_lock mutex after the msft structure has been freed in msft_unregister(). The bug sequence involves: first, msft_do_close() accessing hdev->msft_data, then msft_unregister() freeing the data and setting hdev->msft_data to NULL, followed by an attempt to lock the already freed mutex. This results in a KASAN (Kernel Address Sanitizer) detected slab-use-after-free error in the mutex handling code (Kernel Patch).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that while local access is required, the vulnerability can lead to high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The issue has been fixed by modifying the msft data lifetime management, specifically by moving the freeing operation to hci_release_dev() instead of msft_unregister(). The fix has been implemented in various kernel versions including 6.8.0-40.40 for Ubuntu 24.04 LTS and corresponding versions for other distributions (Ubuntu).