In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan<\/p>\n
For L2CAP sockets without owning sk->sk_socket, reading
\nl2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->
\nl2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks,
\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.<\/p>\n
[Task 1] [Task 2 (hdev->workqueue)]
\n l2cap_sock_release(parent) l2cap_disconn_cfm
\n l2cap_sock_cleanup_listen l2cap_conn_del
\n bt_accept_dequeue l2cap_chan_del
\n lock_sock(sk) l2cap_sock_teardown_cb
\n bt_accept_unlink
\n bt_sk(sk)->parent = NULL
\n release_sock(sk) —————-> lock_sock(sk)
\n parent = \/* NULL *\/
\n lock_sock(sk) chan l2cap_pi(sk)->chan = NULL
\n l2cap_chan_hold_unless_zero l2cap_put_chan(chan)
\n kref_get_unless_zero(&chan->ref)<\/p>\n
Task 1 may observe NULL which causes null-ptr-deref.<\/p>\n
Fix the race by taking lock_sock() in l2cap_sock_kill() to
\nsynchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not
\nneeded here, l2cap_pi(sk)->chan owns reference if it is non-NULL.<\/p>\n
Clarify code comments vs. locking.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan<\/p>\n
For L2CAP sockets without owning sk->sk_socket, reading
\nl2cap_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25500","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}