Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-53238
CVE-2024-53238:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2024-53238 affects the Linux kernel's Bluetooth subsystem, specifically the MediaTek Bluetooth USB driver (btmtk). The vulnerability was discovered and disclosed in December 2024, involving an initialization timing issue in the ISO data anchor that could lead to a NULL pointer crash during USB disconnect operations. The issue affects Linux kernel versions from 6.11 up to (excluding) 6.11.11 and versions from 6.12 up to (excluding) 6.12.2 (NVD).
Technical details
The vulnerability stems from improper initialization timing of the MediaTek ISO data anchor. The issue occurs when there is an unexpected Bluetooth USB disconnect during the setup flow, causing a NULL pointer crash when releasing the ISO anchor since it hasn't been properly initialized. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).
Impact
When exploited, this vulnerability can cause a NULL pointer dereference in the kernel, leading to a system crash (denial of service). The issue specifically manifests during the USB disconnect process, affecting system stability and potentially interrupting Bluetooth operations (NVD).
Mitigation and workarounds
The vulnerability has been patched by adjusting the position of the ISO data anchor initialization to where MediaTek claims the ISO data interface. The fix involves moving the initusbanchor() call from btmtkusbisointfinit() to btusbmtkclaimiso_intf(). Users should update to Linux kernel versions 6.11.11 or 6.12.2 or later to receive the fix (Kernel Patch).
Community reactions
The vulnerability has been acknowledged and addressed by the Linux kernel community, with patches being backported to affected stable kernel versions. Ubuntu has included fixes for this vulnerability in their security updates, indicating its importance for system stability (Ubuntu Notice).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management