CVE-2024-56605: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56605 is a vulnerability discovered in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) implementation. The vulnerability was disclosed on December 27, 2024, and involves a use-after-free issue in the l2cap_sock_create() function. The issue affects multiple versions of the Linux kernel, including versions up to 5.4.287, 5.5 through 5.10.231, 5.11 through 5.15.174, 5.16 through 6.1.120, and 6.2 and later versions (NVD).

The vulnerability occurs in the Bluetooth L2CAP socket creation process where bt_sock_alloc() allocates an sk object and attaches it to the provided sock object. When an error occurs in l2cap_sock_alloc(), the sk object is freed, but the pointer remains attached to the sock object, potentially creating a use-after-free condition in subsequent code execution. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with potential for high impact on confidentiality, integrity, and availability (NVD).

The vulnerability can lead to use-after-free conditions in the Linux kernel's Bluetooth stack, potentially allowing an attacker with local access to execute code, cause system crashes, or escalate privileges. The high CVSS score reflects the potential for significant impact on system security, including the possibility of complete compromise of affected systems (NVD).

A patch has been developed and committed to the Linux kernel to address this vulnerability. The fix involves properly nullifying the socket's sk pointer when freeing the sk object during error handling in l2cap_sock_create(). The patch has been backported to multiple kernel versions and is available through various kernel stable releases (Kernel Patch).