In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update<\/p>\n
MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter
\nupdate changes an existing LE central connection. The queued work currently
\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later
\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry
\nbefore hci_cmd_sync_work() runs the queued callback.<\/p>\n
Do not keep the borrowed hci_conn_params pointer in queued work. Queue the
\nhci_conn instead and hold a reference until the queued callback completes.
\nWhen the work runs, revalidate that the connection is still present, look
\nup the current hci_conn_params entry, and cancel the update if userspace
\nremoved that entry while the work was pending.<\/p>\n
Copy the interval values from the current params entry under hdev->lock,
\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the
\nupdate.<\/p>\n
Validation reproduced this kernel report:
\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a\/0xf0 [bluetooth]
\nRead of size 1 at addr ffff88810c697126 by task kworker\/u17:0\/377
\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]<\/p>\n
Call Trace:<\/p>\n
dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x5f0
\n kasan_report+0xe0\/0x110
\n conn_update_sync+0x2a\/0xf0 [bluetooth]
\n hci_cmd_sync_work+0x187\/0x210 [bluetooth]
\n process_one_work+0x4fd\/0xbc0
\n worker_thread+0x2d8\/0x570
\n kthread+0x1ad\/0x1f0
\n ret_from_fork+0x3c9\/0x540
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Allocated by task 466:
\n hci_conn_params_add+0xa6\/0x240 [bluetooth]
\n load_conn_param+0x4e1\/0x850 [bluetooth]
\n hci_sock_sendmsg+0x96b\/0xf80 [bluetooth]<\/p>\n
Freed by task 474:
\n kfree+0x313\/0x590
\n hci_conn_params_clear_disabled+0x9b\/0xc0 [bluetooth]
\n load_conn_param+0x4bf\/0x850 [bluetooth]
\n hci_sock_sendmsg+0x96b\/0xf80 [bluetooth]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update<\/p>\n
MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single paramete<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5458","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5458","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5458"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5458"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5458"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}