In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_qca: Do not write to the serial port after it is closed<\/p>\n
hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP
\nis set (for example, for the WCN399x family). A failed hci_dev_open_sync()
\nfollowing a successful qca_setup() calls hdev->close() but not
\nhdev->shutdown(), so the port is closed while power->vregs_on is left true.
\nqca_serdev_remove() then passes its power->vregs_on test and calls
\nqca_power_off(), which writes to the closed port unconditionally.<\/p>\n
Seen on a WCN3988 by unbinding the driver after a controller failure. The
\ntrace below is from a 7.0.0 based kernel, where qca_power_off() was still
\nnamed qca_power_shutdown():<\/p>\n
Unable to handle kernel NULL pointer dereference at virtual address
\n 0000000000000038
\n Call trace:
\n tty_set_termios+0x50\/0x238 (P)
\n ttyport_set_baudrate+0x84\/0xc0
\n serdev_device_set_baudrate+0x24\/0x40
\n qca_power_shutdown+0x158\/0x1fc [hci_uart]
\n qca_serdev_remove+0x54\/0x68 [hci_uart]
\n serdev_drv_remove+0x1c\/0x2c
\n device_remove+0x4c\/0x80
\n device_release_driver_internal+0x1cc\/0x224
\n device_driver_detach+0x18\/0x24
\n unbind_store+0xb4\/0xc0<\/p>\n
Check HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place
\nit closes the port, before writing to it. The regulator disable is left
\nunconditional so the controller is still powered down.<\/p>\n
The dangling serport->tty that turns this into a use-after-free is
\naddressed in a separate patch.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_qca: Do not write to the serial port after it is closed<\/p>\n
hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PE<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33363","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}