Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF. Fix by moving the accesses to btusb data to before the data is free'd.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fd913ef7ce619467c6b0644af48ba1fec499c623 to < 297dbf87989e09af98f81f2bcb938041785557e8affectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < f858f004bc343a7ae9f2533bbb2a3ab27428532faffectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < 7a6d1e740220ff9dfcb6a8c994d6ba49e76db198affectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < 5dc00065a0496c36694afe11e52a5bc64524a9b8affectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < 1c28c1e1522c773a94e26950ffb145e88cd9834baffectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < 95b9b98c93b1c0916a3d4cf4540b7f5d69145a0daffectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < a2610ecd9fd5708be8997ca8f033e4200c0bb6afaffectedfd913ef7ce619467c6b0644af48ba1fec499c623 to < 23d22f2f71768034d6ef86168213843fc49bf550affected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected5.4.302 to ≤ 5.4.*unaffected5.10.247 to ≤ 5.10.*unaffected5.15.197 to ≤ 5.15.*unaffected6.1.159 to ≤ 6.1.*unaffected6.6.117 to ≤ 6.6.*unaffected6.12.59 to ≤ 6.12.*unaffected6.17.9 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/297dbf87989e09af98f81f2bcb938041785557e8 ↗
- https://git.kernel.org/stable/c/f858f004bc343a7ae9f2533bbb2a3ab27428532f ↗
- https://git.kernel.org/stable/c/7a6d1e740220ff9dfcb6a8c994d6ba49e76db198 ↗
- https://git.kernel.org/stable/c/5dc00065a0496c36694afe11e52a5bc64524a9b8 ↗
- https://git.kernel.org/stable/c/1c28c1e1522c773a94e26950ffb145e88cd9834b ↗
- https://git.kernel.org/stable/c/95b9b98c93b1c0916a3d4cf4540b7f5d69145a0d ↗
- https://git.kernel.org/stable/c/a2610ecd9fd5708be8997ca8f033e4200c0bb6af ↗
- https://git.kernel.org/stable/c/23d22f2f71768034d6ef86168213843fc49bf550 ↗