In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync<\/p>\n
hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
\nboth rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was
\nobtained from an RCU-protected iteration over hdev->conn_hash.list and
\nis not valid once these locks are dropped. A concurrent disconnect can
\nfree the hci_conn between the unlock and the dereference, causing a
\nuse-after-free read.<\/p>\n
The cancellation mechanism in hci_conn_del() cannot prevent this because
\nhci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:<\/p>\n
hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);<\/p>\n
While hci_conn_del() dequeues with data=conn:<\/p>\n
hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);<\/p>\n
Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never
\nmatches, and the pending work item is not cancelled.<\/p>\n
Fix this by saving conn->conn_timeout into a local variable while the
\nlocks are still held, so the stale conn pointer is never dereferenced
\nafter unlock.<\/p>\n
This is the same class of bug as the one fixed by commit 035c25007c9e
\n(“Bluetooth: hci_sync: Fix UAF on le_read_features_complete”) which
\naddressed the identical pattern in a different function.<\/p>\n
This vulnerability was identified using 0sec.ai, an open-source
\nautomated security auditing platform (https:\/\/github.com\/0sec-labs).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync<\/p>\n
hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
\nbo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14973","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}