| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025050104-CVE-2022-49910-96ae@gregkh> Date: Thu, 1 May 2025 16:11:40 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2022-49910: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb. 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8). Fix it by keeping a local copy of struct l2cap_ctrl. BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169 Workqueue: hci0 hci_rx_work [bluetooth] Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth ret_from_fork (arch/x86/entry/entry_64.S:306) </TASK> Allocated by task 43169: kasan_save_stack (mm/kasan/common.c:39) __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) __alloc_skb (net/core/skbuff.c:414) l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth process_one_work (kernel/workqueue.c:2289) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:306) Freed by task 27920: kasan_save_stack (mm/kasan/common.c:39) kasan_set_track (mm/kasan/common.c:45) kasan_set_free_info (mm/kasan/generic.c:372) ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328) slab_free_freelist_hook (mm/slub.c:1780) kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553) skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth sock_read_iter (net/socket.c:1087) new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401) vfs_read (fs/read_write.c:482) ksys_read (fs/read_write.c:620) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) The Linux kernel CVE team has assigned CVE-2022-49910 to this issue. Affected and fixed versions =========================== Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.9.333 with commit dc30e05bb18852303084430c03ca76e69257d9ea Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.14.299 with commit 03af22e23b96fb7ef75fb7885407ef457e8b403d Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.19.265 with commit 6c7407bfbeafc80a04e6eaedcf34d378532a04f2 Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.4.224 with commit 4cd094fd5d872862ca278e15b9b51b07e915ef3f Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.10.154 with commit cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569 Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.15.78 with commit 8278a87bb1eeea94350d675ef961ee5a03341fde Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 6.0.8 with commit 9a04161244603f502c6e453913e51edd59cb70c1 Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 6.1 with commit 3aff8aaca4e36dc8b17eaa011684881a80238966 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49910 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bluetooth/l2cap_core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/dc30e05bb18852303084430c03ca76e69257d9ea https://git.kernel.org/stable/c/03af22e23b96fb7ef75fb7885407ef457e8b403d https://git.kernel.org/stable/c/6c7407bfbeafc80a04e6eaedcf34d378532a04f2 https://git.kernel.org/stable/c/4cd094fd5d872862ca278e15b9b51b07e915ef3f https://git.kernel.org/stable/c/cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569 https://git.kernel.org/stable/c/8278a87bb1eeea94350d675ef961ee5a03341fde https://git.kernel.org/stable/c/9a04161244603f502c6e453913e51edd59cb70c1 https://git.kernel.org/stable/c/3aff8aaca4e36dc8b17eaa011684881a80238966
Powered by blists - more mailing lists