In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths<\/p>\n
Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer
\nDereference (NPD) conditions were observed in the lifecycle management
\nof hci_uart.<\/p>\n
The primary issue arises because the workqueues (init_ready and
\nwrite_work) are only flushed\/cancelled if the HCI_UART_PROTO_READY
\nflag is set during TTY close. If a hangup occurs before setup completes,
\nhci_uart_tty_close() skips the teardown of these workqueues and
\nproceeds to free the `hu` struct. When the scheduled work executes
\nlater, it blindly dereferences the freed `hu` struct.<\/p>\n
Furthermore, several data races and UAFs were identified in the teardown
\nsequence:
\n1. Calling hci_uart_flush() from hci_uart_close() without effectively
\n disabling write_work causes a race condition where both can concurrently
\n double-free hu->tx_skb. This happens because protocol timers can
\n concurrently invoke hci_uart_tx_wakeup() and requeue write_work.
\n2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF
\n when vendor specific protocol close callbacks dereference hu->hdev.
\n3. In the initialization error paths, failing to take the proto_lock
\n write lock before clearing PROTO_READY leads to races with active
\n readers. Additionally, hci_uart_tty_receive() accesses hu->hdev
\n outside the read lock, leading to UAFs if the initialization error
\n path frees hdev concurrently.<\/p>\n
Fix these synchronization and lifecycle issues by:
\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,
\n followed immediately by a cancel_work_sync(&hu->write_work). Clearing
\n the flag locks out concurrent protocol timers from successfully invoking
\n hci_uart_tx_wakeup(), effectively rendering the cancellation permanent
\n and preventing the tx_skb double-free.
\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip
\n hu->proto->flush(). This is perfectly safe in the tty_close path
\n because hu->proto->close() executes shortly after, which intrinsically
\n purges all protocol SKB queues and tears down the state.
\n3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev)
\n across all close and error paths to prevent vendor-level UAFs.
\n4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive()
\n inside the proto_lock read-side critical section to safely synchronize
\n with device unregistration.
\n5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely
\n flush the workqueue before hci_uart_flush() is invoked via the HCI core.
\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across
\n all paths to prevent permanently breaking user-space retry capabilities.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths<\/p>\n
Vulnerabilities leading to Use-After-Free (UAF) and Null<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15963","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}