In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: SCO: give the socket its own sco_conn reference<\/p>\n
sco_conn_del() drops a reference it does not own. It takes one transient
\nreference via sco_conn_hold_unless_zero() and releases it with the
\nsco_conn_put() that follows sco_sock_hold(); the additional put in the
\n!sk branch releases a second one:<\/p>\n
conn = sco_conn_hold_unless_zero(conn);
\n …
\n sk = sco_sock_hold(conn);
\n sco_conn_unlock(conn);
\n sco_conn_put(conn);<\/p>\n
if (!sk) {
\n sco_conn_put(conn);
\n return;
\n }<\/p>\n
When close() races the controller’s Disconnection Complete, sco_chan_del()
\nclears conn->sk and drops the socket’s reference while sco_conn_del() is
\nrunning. sco_conn_del() then sees sk == NULL, its own put drops the count
\nto zero and frees the conn, and the second put writes to the freed kref:<\/p>\n
BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a\/0x190
\n Write of size 4 at addr ffff8881099dec74 by task kworker\/u17:3\/413
\n Workqueue: hci1 hci_rx_work
\n Call Trace:
\n sco_conn_put.part.0+0x1a\/0x190
\n hci_disconn_complete_evt+0x1ee\/0x3e0
\n hci_event_packet+0x54a\/0x650
\n hci_rx_work+0x321\/0x3d0
\n Allocated by task 413:
\n sco_conn_add+0x72\/0x1a0
\n sco_connect_cfm+0x88\/0x670
\n Freed by task 413:
\n sco_conn_del.isra.0+0x3f\/0xf0
\n hci_disconn_complete_evt+0x1ee\/0x3e0
\n refcount_t: underflow; use-after-free.<\/p>\n
The root cause is that the socket stores the connection without holding a
\nreference of its own. __sco_chan_add() does:<\/p>\n
sco_pi(sk)->conn = conn;<\/p>\n
so the socket borrows whatever reference its caller happened to hold, and
\nthe callers paper over that with ad-hoc holds and puts. Give the socket a
\ncounted reference instead: __sco_chan_add() takes one and it is released
\ntogether with the channel (sco_chan_del()) and in sco_sock_destruct().
\nWith the socket holding its own reference, sco_conn_del() no longer needs
\nthe extra put and the redundant hold in sco_conn_ready() goes away.<\/p>\n
Making the socket own its reference means the connection is now actually
\nfreed on the error paths of sco_connect() where it used to leak, which in
\nturn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the
\nhci_conn accounting balanced, make that ownership explicit as well:
\nsco_conn_add() consumes one hci_conn reference and the sco_conn owns it for
\nits lifetime. sco_connect() hands over the reference returned by
\nhci_connect_sco() and no longer drops it on the error paths;
\nsco_connect_cfm(), which is not given a reference, takes one with
\nhci_conn_hold() before handing it to sco_conn_add() (and drops it again if
\nthe allocation fails); and the explicit hci_conn_hold() in sco_conn_ready()
\nis removed. Every reference then has a single, clear owner.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: SCO: give the socket its own sco_conn reference<\/p>\n
sco_conn_del() drops a reference it does not own. It takes one transien<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12340","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}