Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 藍牙l2cap修正 l2cap_chan_timeout 中的 null-ptr-deref l2cap_chan_timeout() 和 l2cap_chan_del() 之間有爭用情形。當我們使用 l2cap_chan_del() 刪除通道時chan->conn 會設為 null。但是 conn 可能會在 l2cap_chan_timeout() 的 mutex_lock() 中再次解除參照。因此會發生 null 指標解除參照錯誤。POC 觸發的 KASAN 報告如下所示[ 472.074580] ==================================== ============================== [472.075284] 錯誤KASANmutex_lock+0x68/0xc0 中的 null-ptr-deref [ 472.0753080:0 工作 kworker0:0/ #36 在 472.075308addr 0000000000000158 寫入大小 472.075308為8 的內容。  [ 472.075308] 硬體名稱QEMU Standard PC (i440FX + PIIX, 1996)、BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] 工作佇列事件 l2cap_chan_timeout [472.075308] 呼叫追踪 [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ========================== ======================================== [472.094860] 因核心而停用鎖定除錯污染 [ 472.096136] 錯誤核心 NULL 指標解除參照、位址0000000000000158 [ 472.096136] #PF核心模式中的監督寫入存取權 [472.096136] #PFerror_code(0x0002) - 不存在頁面 [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 受污染的 GB 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] 硬體名稱QEMU Standard PC (i440FX + PIIX, 1996)BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] 工作佇列事件 l2cap_chan_timeout [472.096136] RIP 0010:mutex_lock+0x88/0xc0 [ 472.096136] 代碼be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP0018:ffff88800744fc78 EFLAGS
    00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08:
    ffff88800744fc7f R091ffff11000e89f8f [ 472.096136] R10dffffc0000000000 R11ffffed1000e89f90 R12
    dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS:
    0010 DS 0000 ES 0000 CR0 0000000080050033 [ 472.096136] CR2 0000000000000158 CR3 000000000da32000 CR4 00000000000006f0 [ 472.096136] 呼叫追踪 [ 472.096136] [ ] [ [] ] ? <TASK> ] [ 472.096136 ] __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeo ---truncated--- (CVE-2024-27399)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2024-27399

medium Nessus Plugin ID 228181

版本 1.18