Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths: - the return value is not checked, and hci_cmd_sync_queue() does not take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM); - a cancelled entry is not released, as _hci_cmd_sync_cancel_entry() does not free entry->data when there is no destroy callback. hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c249ea9b4309cf3250c5bbb42a05d38d0ed9071c to < c2019224a766245b7db39d87fdfe84c3fdc879d9affectedc249ea9b4309cf3250c5bbb42a05d38d0ed9071c to < 193182c6467f508a8a61d5db506d796ffed6eee6affectedc249ea9b4309cf3250c5bbb42a05d38d0ed9071c to < 2e3d827cd56865c14f6ca118bbccd7801091fb21affectedc249ea9b4309cf3250c5bbb42a05d38d0ed9071c to < 9c3b6c1413bd0b4993642d987616331f84d9b7f5affectedc249ea9b4309cf3250c5bbb42a05d38d0ed9071c to < bb5ca1cc7744c41c59002bd6523714a685ae6595affectedc249ea9b4309cf3250c5bbb42a05d38d0ed9071c to < 120d8dc042e3d45073bb6e50ee7b058a0b182627affected
Linux Linux
Default version status: affected
6.1affected0 to < 6.1unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c2019224a766245b7db39d87fdfe84c3fdc879d9 ↗
- https://git.kernel.org/stable/c/193182c6467f508a8a61d5db506d796ffed6eee6 ↗
- https://git.kernel.org/stable/c/2e3d827cd56865c14f6ca118bbccd7801091fb21 ↗
- https://git.kernel.org/stable/c/9c3b6c1413bd0b4993642d987616331f84d9b7f5 ↗
- https://git.kernel.org/stable/c/bb5ca1cc7744c41c59002bd6523714a685ae6595 ↗
- https://git.kernel.org/stable/c/120d8dc042e3d45073bb6e50ee7b058a0b182627 ↗