Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7b445e220db9a2c58be5d09bbbd322abf1b1452a to < 84674dd1d3192ecb050827d3148642609c0c9dbbaffected7b445e220db9a2c58be5d09bbbd322abf1b1452a to < b56f2ecafc08f372bf0529f9c4f3f429cb1702dcaffected7b445e220db9a2c58be5d09bbbd322abf1b1452a to < f915e74b6f18293d1d69a2a3305ef321ff7c0172affected7b445e220db9a2c58be5d09bbbd322abf1b1452a to < d5b3b484b62bb0f4542e7622789d28871626cdf0affected7b445e220db9a2c58be5d09bbbd322abf1b1452a to < ecdcb55ea1c01dda074406f38058785a69526734affected7b445e220db9a2c58be5d09bbbd322abf1b1452a to < da55f570191d5d72f10c607a7043b947eb05ea46affected
Linux Linux
Default version status: affected
6.0affected0 to < 6.0unaffected6.1.189 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/84674dd1d3192ecb050827d3148642609c0c9dbb ↗
- https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc ↗
- https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172 ↗
- https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0 ↗
- https://git.kernel.org/stable/c/ecdcb55ea1c01dda074406f38058785a69526734 ↗
- https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46 ↗