In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_conn: Lock parent access during enhanced SCO setup<\/p>\n
Bluetooth: hci_conn: Lock parent access during enhanced SCO setup<\/p>\n
hci_enhanced_setup_sync() runs on the request workqueue without the
\nhci_dev_lock held by its caller when setup was queued. Its CVSD
\ncapability check and find_next_esco_param() dereference conn->parent
\nwhile the receive workqueue can unlink and release that parent.<\/p>\n
The following interleaving can cause a use-after-free:<\/p>\n
hci_enhanced_setup_sync() hci_disconn_complete_evt()
\n load conn->parent
\n hci_dev_lock()
\n hci_conn_del(ACL parent)
\n unlink SCO child
\n drop link’s parent reference
\n clear child->parent
\n release ACL parent
\n bt_link_release()
\n kfree(parent)
\n hci_dev_unlock()
\n read parent->features[0][3]<\/p>\n
The reference held for the queued SCO child does not keep its ACL parent
\nalive after unlinking. Commit 42de40abe25d (“Bluetooth: hci_conn: fix the
\nSCO setup context lifetime”) protects the child stored in the queued
\ncontext, but leaves these parent accesses unprotected.<\/p>\n
With a 40 ms diagnostic delay after loading conn->parent, an instrumented
\nkernel based on fd179f8a05be, which already contains 42de40abe25d,<\/p>\n
BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0xda5\/0xdf0
\n Read of size 1 at addr ffff888102204047 by task kworker\/u17:0\/93
\n Call Trace:
\n hci_enhanced_setup_sync+0xda5\/0xdf0
\n hci_cmd_sync_work+0x13c\/0x290
\n process_one_work+0x6b4\/0x10e0<\/p>\n
Allocated by task 92:
\n __hci_conn_add+0x304\/0x1df0
\n hci_connect_acl+0x349\/0x3e0
\n hci_connect_sco+0x3b\/0x9a0
\n sco_sock_connect+0x475\/0xca0<\/p>\n
Freed by task 94:
\n kfree+0x121\/0x3c0
\n bt_link_release+0x79\/0xa0
\n device_release+0xc8\/0x240
\n kobject_put+0x14d\/0x280
\n hci_conn_del+0x524\/0xe30
\n hci_disconn_complete_evt+0x403\/0x8c0
\n hci_event_packet+0x71b\/0xb20
\n hci_rx_work+0x293\/0x730<\/p>\n
The accessed address is 71 bytes into the freed ACL parent, at its
\nfeatures[0][3] byte; the queued SCO child is a different object. The
\ndiagnostic preserves the loaded parent across the delay, matching the
\nunmodified compiled capability check, and does not change the parent
\nreferences or teardown path.<\/p>\n
Hold hci_dev_lock() across the codec switch, including every call to
\nfind_next_esco_param(), and release it on all selection errors. Keep
\nconfigure_datapath_sync() outside the critical section because it waits
\nfor HCI events. Preserve parameter selection and existing return values.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_conn: Lock parent access during enhanced SCO setup<\/p>\n
Bluetooth: hci_conn: Lock parent access during enhanced SCO setu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41208","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}