Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev->lock held. Fix by holding the lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
70c464256310e1c3716099b9d02ece4169272f73 to < 60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4affected70c464256310e1c3716099b9d02ece4169272f73 to < 9d4a6c0f43fc5e4d4f062e8e450e5483eb74176eaffected70c464256310e1c3716099b9d02ece4169272f73 to < c7777f534a8018ae4bb1c80d8925af4df588a314affected70c464256310e1c3716099b9d02ece4169272f73 to < 6b4d226d01ab7da0d2027a2a1e3a6079152e5065affected70c464256310e1c3716099b9d02ece4169272f73 to < 541d5bf9b5afaf41090b2a3aa7b47f2db2ff801faffected70c464256310e1c3716099b9d02ece4169272f73 to < 385b2d0468a0871fc716c549fa3b0c257c7dbcb3affected70c464256310e1c3716099b9d02ece4169272f73 to < c27224daf0b08efbb2b24ed64b6139b294f5473aaffected70c464256310e1c3716099b9d02ece4169272f73 to < 5c7209a341ff2ac338b2b0375c34a307b37c9ac2affected
Linux Linux
Default version status: affected
3.17affected0 to < 3.17unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4 ↗
- https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e ↗
- https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314 ↗
- https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065 ↗
- https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f ↗
- https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3 ↗
- https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a ↗
- https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2 ↗