CVE-2024-53208

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user with administrative privileges can trigger a use-after-free condition by issuing Bluetooth power configuration commands while the controller interface is closing. This flaw allows an attacker to cause a Denial of Service (DoS) through a system crash or potentially execute arbitrary code by dereferencing freed kernel memory.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the Bluetooth kernel module from loading on systems where Bluetooth functionality is not required.

1. Create a configuration file to disable loading the module:

echo "install bluetooth /bin/true" > /etc/modprobe.d/disable-bluetooth.conf

2. Additionally, blacklist the module:

echo "blacklist bluetooth" >> /etc/modprobe.d/disable-bluetooth.conf

Caveats: Disabling the bluetooth module will prevent all Bluetooth devices and networking from functioning. If the module is already loaded into memory, a system restart is required for the configuration to take effect.