In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: Protect UUID list traversal<\/p>\n
The hci_sync conversion moved class-of-device and EIR generation from an
\nHCI request built under hdev->lock to asynchronous command sync work.
\nThe worker holds hdev->req_lock, but that lock does not serialize access
\nto hdev->uuids against add_uuid() and remove_uuid(), which update the
\nlist under hdev->lock.<\/p>\n
The following interleaving can therefore occur:<\/p>\n
CPU0 (command sync work) CPU1 (management socket)
\n fetch uuid from the list
\n list_del(&uuid->list)
\n kfree(uuid)
\n read uuid->size<\/p>\n
KASAN reports the resulting use-after-free:<\/p>\n
BUG: KASAN: slab-use-after-free in eir_create+0xb8f\/0xee0
\n Read of size 1 at addr ffff88810dbd8620 by task kworker\/u17:0\/87
\n Workqueue: hci0 hci_cmd_sync_work
\n Call Trace:
\n eir_create+0xb8f\/0xee0
\n hci_update_eir_sync+0x1c0\/0x330
\n hci_cmd_sync_work+0x13c\/0x290
\n process_one_work+0x63a\/0x1070
\n worker_thread+0x45b\/0xd10<\/p>\n
Allocated by task 86:
\n __kasan_kmalloc+0x8f\/0xa0
\n add_uuid+0x18a\/0x4b0
\n hci_sock_sendmsg+0x1033\/0x1ea0<\/p>\n
Freed by task 92:
\n __kasan_slab_free+0x43\/0x70
\n kfree+0x131\/0x3c0
\n remove_uuid+0x25e\/0x560
\n hci_sock_sendmsg+0x1033\/0x1ea0<\/p>\n
Hold hdev->lock while generating and committing the class-of-device and
\nEIR snapshots. Release it before sending an HCI command, so controller
\nwaits do not happen under the device lock. This protects all UUID list
\nwalks in these paths and restores the serialization lost in the command
\nsync conversion.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: Protect UUID list traversal<\/p>\n
The hci_sync conversion moved class-of-device and EIR generation from an
\nHCI requ<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5374","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}