In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: Serialize fragmented ISO packet queueing<\/p>\n
The fragmented path in hci_queue_iso() calls __skb_queue_tail() without
\nholding conn->data_q.lock. The socket lock serializes senders, but the
\ntransmit worker can concurrently remove packets from this queue using
\nskb_dequeue().<\/p>\n
After an insertion saves the old tail pointer, hci_sched_iso() can dequeue
\nthat packet and pass it to the driver. The driver can free the packet
\nbefore the insertion resumes and writes to the old tail’s next pointer,
\ncausing a use-after-free. Concurrent updates can also corrupt the queue.<\/p>\n
KASAN reported:<\/p>\n
BUG: KASAN: slab-use-after-free in hci_send_iso+0xc7d\/0xe10
\n Call Trace:
\n hci_send_iso+0xc7d\/0xe10
\n iso_sock_sendmsg+0x710\/0x900
\n __sys_sendto+0x34a\/0x3a0<\/p>\n
Allocated by task 86:
\n __alloc_skb+0xdd\/0x820
\n alloc_skb_with_frags+0x7e\/0x770
\n sock_alloc_send_pskb+0x67a\/0x820
\n bt_skb_sendmsg.constprop.0+0xc0\/0x6c0
\n iso_sock_sendmsg+0x44e\/0x900<\/p>\n
Freed by task 90:
\n kmem_cache_free+0xcb\/0x3d0
\n vhci_read+0x33f\/0x4d0
\n vfs_read+0x177\/0xa20<\/p>\n
Hold the queue lock across the entire fragment batch, as hci_queue_acl()
\ndoes, to serialize insertion against dequeue while preserving fragment
\nordering.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: Serialize fragmented ISO packet queueing<\/p>\n
The fragmented path in hci_queue_iso() calls __skb_queue_tail() with<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41205","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}