In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: Serialize local codec list cleanup<\/p>\n
hci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock.
\nCodec list additions and both traversals in sco_sock_getsockopt() use that
\nlock, but the close path does not. A close and BT_CODEC query can therefore
\ninterleave as follows:<\/p>\n
hci_dev_close_sync() sco_sock_getsockopt()
\n hci_dev_lock()
\n fetch codec entry
\n hci_codec_list_clear()
\n kfree(entry)
\n read entry->id<\/p>\n
The reader then accesses an entry which the close path has freed. KASAN<\/p>\n
BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0\/0xfe0
\n Read of size 1 at addr ffff8881001c3450
\n Call Trace:
\n sco_sock_getsockopt+0xfa0\/0xfe0
\n do_sock_getsockopt+0x537\/0x7b0
\n __sys_getsockopt+0xf2\/0x170
\n Allocated by task 92:
\n hci_codec_list_add.isra.0+0x2c\/0x440
\n hci_read_codec_capabilities+0x224\/0x590
\n hci_read_supported_codecs+0x2c2\/0x640
\n Freed by task 92:
\n kfree+0x131\/0x3c0
\n hci_codec_list_clear+0xd8\/0x160
\n hci_dev_close_sync+0x92a\/0xfa0<\/p>\n
Take hdev->lock around the clear operation at its existing point in the
\nclose path. This makes the clear wait for active readers and prevents a new
\ntraversal until the list is empty without changing teardown ordering.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: Serialize local codec list cleanup<\/p>\n
hci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33315","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}