In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel<\/p>\n
In send_cancel(), pending mesh_tx objects are removed from the
\nhdev->mesh_pending list and freed via mesh_send_complete(). However, if
\na mesh transmission was already queued onto hdev->cmd_sync_work_list via
\nmesh_next(), the queued entry retains a raw pointer to mesh_tx.<\/p>\n
When hci_cmd_sync_work later processes the entry, it attempts to execute
\nmesh_send_sync and its destroy callback mesh_send_start_complete using
\nthe already freed mesh_tx pointer, leading to a use-after-free.<\/p>\n
Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the
\ntarget mesh_tx before completing it. If the entry is found and dequeued,
\nits destroy callback will complete and free the object; otherwise,
\nmesh_send_complete() is called directly.<\/p>\n
Additionally, ensure the transmission queue advances after cancellation
\nor errors. In mesh_send_start_complete(), call mesh_next() on error
\nunless err is -ECANCELED, because hci_cmd_sync_dequeue() holds
\nhdev->cmd_sync_work_lock and calling mesh_next() synchronously would
\ndeadlock. Instead, advance the queue in send_cancel() once the lock is
\nreleased and if no transmission is in progress.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel<\/p>\n
In send_cancel(), pending mesh_tx objects are removed from the
\nh<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41104","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}