CVE-2024-41062: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-f6q4-wr98-4jf5
Share
CVSS 5.5
Published
Advisory Summary

CVE-2024-41062 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2024-41062 at a Glance

CVE Identifier CVE-2024-41062
GHSA Identifier GHSA-f6q4-wr98-4jf5
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2024-41062

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2024-41062, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data. Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.

References

NVD — CVE-2024-41062 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41062
git.kernel.org/stable/c/2243127db6... WEB
https://git.kernel.org/stable/c/2243127db6ba20cbef90c6349a2b1000af401d2e
git.kernel.org/stable/c/3b732449b7... WEB
https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629
git.kernel.org/stable/c/59a3ccd749... WEB
https://git.kernel.org/stable/c/59a3ccd749b2550392ee531b4d727022eae4c89f
git.kernel.org/stable/c/605572e64c... WEB
https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf
git.kernel.org/stable/c/89e856e124... WEB
https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe
git.kernel.org/stable/c/9c0b7d61cf... WEB
https://git.kernel.org/stable/c/9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa
git.kernel.org/stable/c/b803f30ea2... WEB
https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Frequently Asked Questions

What is CVE-2024-41062?
CVE-2024-41062 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2024-41062?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2024-41062?
CVE-2024-41062 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2024-41062?
CVE-2024-41062 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2024-41062?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f6q4-wr98-4jf5",
  "modified" : "2026-10-03T12:31:00Z",
  "published" : "2024-07-29T15:30:44Z",
  "aliases" : [ "CVE-2024-41062" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n           CPU0                       CPU1\n           ----                       ----\n           sock_close                 hci_rx_work\n\t   l2cap_sock_release         hci_acldata_packet\n\t   l2cap_sock_kill            l2cap_recv_frame\n\t   sk_free                    l2cap_conless_channel\n\t                              l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-41062"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2243127db6ba20cbef90c6349a2b1000af401d2e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3b732449b78183d17178db40be3a4401cf3cd629"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/59a3ccd749b2550392ee531b4d727022eae4c89f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/605572e64cd9cebb05ed609d96cff05b50d18cdf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/89e856e124f9ae548572c56b1b70c2255705f8fe"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9c0b7d61cf3c00f87f2529b5b8b785f0f65089aa"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b803f30ea23e0968b6c8285c42adf0d862ab2bf6"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2024-07-29T15:15:14Z"
  }
}