Security readout for executives and security teams
Plain-English summary
A Linux Bluetooth kernel race can access memory after an SCO socket has been freed. This may crash or corrupt the system; the CVSS assessment also allows potential confidentiality, integrity, and availability impact. The supplied evidence demonstrates the defect with a KASAN-triggering proof of concept, but does not establish real-world compromise.
Executive priority
Treat this as a high-priority kernel maintenance issue on Bluetooth-enabled or multi-user Linux systems. Accelerate normal patching where SCO functionality is exposed to less-trusted users. Emergency response is not supported by the supplied evidence because active exploitation is unconfirmed and the stated attack vector is adjacent rather than internet-remote.
Technical view
A delayed timeout worker scheduled during SCO socket closure can run after sock_put deallocates the socket. sco_sock_timeout then calls sock_hold on the freed object, producing a slab use-after-free. The supplied CVSS v3.1 score is 8.0, with adjacent access, low privileges, no user interaction, and potentially high impact.
Likely exposure
Exposure centers on Linux systems running affected kernels where Bluetooth SCO functionality is available. The CVSS vector indicates adjacent access and low privileges, which constrain reachability compared with an unauthenticated remote flaw. The bundle lists affected versions, but its version data is ambiguous; confirm status through the relevant Linux distributor or appliance vendor.
Exploitation context
The source describes a proof of concept that triggered a KASAN use-after-free report. CVE-2024-27398 is not marked as CISA KEV in the supplied bundle, and no cited evidence establishes active exploitation. The bundle also does not demonstrate whether practical outcomes extend beyond memory corruption or denial of service.
Researcher notes
The race occurs between sco_sock_release freeing the socket and delayed timeout work dereferencing it. Multiple stable-kernel commits are cited as fixes. The supplied affected-version representation contains commit identifiers and releases without clear range semantics, so package-level exposure needs vendor confirmation. No CWE was supplied, although the described defect is explicitly a use-after-free.
Mitigation direction
- Install a vendor-supported kernel update containing the cited SCO socket timeout fix.
- Prioritize Bluetooth-capable systems where untrusted low-privilege users can access SCO functionality.
- If patching is delayed, restrict unnecessary Bluetooth access or disable Bluetooth where operationally acceptable.
- Reboot into the updated kernel and verify the vulnerable kernel is no longer running.
Validation and detection
- Inventory Linux systems with Bluetooth enabled and record running kernel and distributor package versions.
- Compare packages with distributor advisories and cited stable-kernel fixes; do not rely solely on upstream version strings.
- Confirm the deployed kernel contains the SCO socket timeout fix after maintenance.
- Review kernel diagnostics for use-after-free reports referencing sco_sock_timeout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27398 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249CVE reference, Linux
- https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014CVE reference, Linux
- https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53CVE reference, Linux
- https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5CVE reference, Linux
- https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93CVE reference, Linux
- https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2CVE reference, Linux
- https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178CVE reference, Linux
- https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546CVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/CVE reference, CVE · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/CVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20240912-0012/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.