In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock<\/p>\n
iso_sock_close() calls iso_sock_clear_timer() before acquiring
\nlock_sock(sk).<\/p>\n
iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the
\nsocket lock held:<\/p>\n
if (!iso_pi(sk)->conn)
\n return;
\n cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);<\/p>\n
Concurrently, iso_conn_del() executes under lock_sock(sk) and calls
\niso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in
\nthe final reference to the connection being dropped:<\/p>\n
CPU0 CPU1
\n —- —-
\n iso_sock_clear_timer()
\n if (conn != NULL) … lock_sock(sk)
\n iso_chan_del()
\n iso_pi(sk)->conn = NULL
\n cancel_delayed_work(conn) \/* NULL deref or UAF *\/<\/p>\n
iso_pi(sk)->conn is not stable across the unlock window, causing a
\nNULL pointer dereference or use-after-free.<\/p>\n
Serialize iso_sock_clear_timer() with the socket lock by moving it
\ninside lock_sock()\/release_sock(), matching the pattern used in
\niso_conn_del() and all other call sites.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock<\/p>\n
iso_sock_close() calls iso_sock_clear_timer() before acquiring
\nloc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14974","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}