In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: mgmt: fix ‘hdev->discovery.uuids’ NULL dereference<\/p>\n
‘uuid_count’ member of struct ‘discovery_state’ is assigned and read
\nwithout any locks, so there is a chance of situation when
\nuuid_count != 0, but uuids is NULL and there will be NULL pointer
\ndereference.<\/p>\n
Possible race:
\n‘hci_update_passive_scan_sync’
\n ‘hci_discovery_filter_clear’
\n hdev->discovery.uuid_count = 0;<\/p>\n
‘start_service_discovery’
\n \/\/ Set uuid_count to value != 0
\n hdev->discovery.uuid_count = uuid_count;
\n hdev->discovery.uuids = kmemdup(…);<\/p>\n
spin_lock(&hdev->discovery.lock);
\n kfree(hdev->discovery.uuids);
\n hdev->discovery.uuids = NULL;
\n spin_unlock(&hdev->discovery.lock);<\/p>\n
Now uuids == NULL and uuid_count != 0.
\nSo ‘mgmt_device_found’ -> ‘is_filter_match’ -> ‘eir_has_uuids’ receives
\nnon consistent discovery state, where NULL dereference of uuids happens.<\/p>\n
To fix it let’s add discovery.lock around every read\/write of uuid_count,
\nuuids pair of struct members. It is also important to assign uuid_count
\nvalue only after success kmemdup() allocation in
\nstart_service_discovery(), otherwise uuids is NULL, because kmemdup failed,
\nbut uuid_count is already assigned to non zero value.<\/p>\n
The following panic happens:<\/p>\n
[ ] ————[ cut here ]————
\n[ ] Unable to handle kernel NULL pointer dereference at virtual
\naddress 0000000000000000
\n[ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
\n[ ] CPU: 0 PID: 15056 Comm: kworker\/u9:2
\n[ ] Workqueue: hci0 hci_rx_work
\n[ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=–)
\n[ ] pc : eir_has_uuids+0x2d8\/0x590
\n[ ] lr : is_filter_match+0x258\/0x320
\n…
\n[ ] Call trace:
\n[ ] eir_has_uuids+0x2d8\/0x590
\n[ ] is_filter_match+0x258\/0x320
\n[ ] mgmt_device_found+0x5b0\/0xafc
\n[ ] process_adv_report.part.0+0x8c8\/0xf14
\n[ ] hci_le_adv_report_evt+0x338\/0x3f0
\n[ ] hci_le_meta_evt+0x1f0\/0x4c8
\n[ ] hci_event_packet+0x440\/0xc9c
\n[ ] hci_rx_work+0x44c\/0xaf8
\n[ ] process_one_work+0x54c\/0x103c
\n[ ] worker_thread+0x6c4\/0x10c4
\n[ ] kthread+0x274\/0x2ec
\n[ ] ret_from_fork+0x10\/0x20
\n[ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024)
\n[ ] —[ end trace 0000000000000000 ]—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: mgmt: fix ‘hdev->discovery.uuids’ NULL dereference<\/p>\n
‘uuid_count’ member of struct ‘discovery_state’ is assigned and read<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28511","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28511","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28511"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28511"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}