linux-kernel - Re: [BUG]: slab-use-after-free Write in sco_conn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKa5YKgAP5L+uBr3R0Au_n_s4N73y0NPFVh0y1XYPaAJyuCB5w@mail.gmail.com>
Date: Fri, 19 Sep 2025 16:57:34 +0800
From: haoran zheng <zhenghaoran154@...il.com>
To: cen zhang <zzzccc427@...il.com>
Cc: Luiz Augusto von Dentz <luiz.dentz@...il.com>, johan.hedberg@...il.com, marcel@...tmann.org, 
	linux-kernel@...r.kernel.org, baijiaju1990@...il.com, r33s3n6@...il.com, 
	linux-bluetooth@...r.kernel.org, "gality369@...il.com" <gality369@...il.com>
Subject: Re: [BUG]: slab-use-after-free Write in sco_conn_put

> RACE CONDITION SEQUENCE:
>    a) Task 31374 releases socket, eventually leading to sco_conn_free()
>    b) sco_conn_free() sets hcon->sco_data = NULL and calls kfree(conn)
>    c) Task 352 (workqueue) executes hci_conn_failed() -> sco_connect_cfm()
>    d) sco_connect_cfm() calls sco_conn_del(hcon, bt_to_errno(status))
>    e) sco_conn_del() attempts to access already-freed sco_conn via
> hcon->sco_data

I think this vulnerability should be located at sco_pi(conn->sk)->conn = NULL;

Specifically, when sco_sock_release is called in the Free Path,
conn->sk is set to NULL under the protection of sco_conn_lock(conn),
and the TOCTOU problem occurs at line 87 of sco.c. When performing the
if (conn->sk) judgment, conn->sk has not been free yet. However, when
sco_sock_release is called After the judgment is executed, resulting
in conn->sk being free, it causes Use After Free.