Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb_data by rx_work btusb_close() and btusb_flush() cancel data->rx_work with the asynchronous cancel_delayed_work(), so if btusb_rx_work() is already running on another CPU it keeps running after the cancel returns. btusb_disconnect() calls hci_unregister_dev(), which invokes btusb_close(), and then frees the btusb_data. A still running btusb_rx_work() then dereferences the freed data: while ((skb = skb_dequeue(&data->acl_q))) data->recv_acl(data->hdev, skb); Use cancel_delayed_work_sync() instead. In btusb_close() the cancel also has to happen after btusb_stop_traffic(), otherwise an URB completion racing with the cancel can requeue the work right after it has been waited for.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
800fe5ec302e1ebbf5e3f891f886deecd49c7132 to < fc654a72a8d979db15e2773a481e931abaf5a9e8affected800fe5ec302e1ebbf5e3f891f886deecd49c7132 to < 5242050195a711e9cd6a9935f689ab6656b94a91affected800fe5ec302e1ebbf5e3f891f886deecd49c7132 to < 472d005622525b7be155cac99dde2252b0163bd1affected800fe5ec302e1ebbf5e3f891f886deecd49c7132 to < 93b59937bda3fffc6386c79f5544a39bc680c8e8affected800fe5ec302e1ebbf5e3f891f886deecd49c7132 to < fa391adb9c755515a89993634745e9079e5ef37caffected800fe5ec302e1ebbf5e3f891f886deecd49c7132 to < 1c12c3117639e78940959d956519c758c57d0849affected
Linux Linux
Default version status: affected
5.17affected0 to < 5.17unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fc654a72a8d979db15e2773a481e931abaf5a9e8 ↗
- https://git.kernel.org/stable/c/5242050195a711e9cd6a9935f689ab6656b94a91 ↗
- https://git.kernel.org/stable/c/472d005622525b7be155cac99dde2252b0163bd1 ↗
- https://git.kernel.org/stable/c/93b59937bda3fffc6386c79f5544a39bc680c8e8 ↗
- https://git.kernel.org/stable/c/fa391adb9c755515a89993634745e9079e5ef37c ↗
- https://git.kernel.org/stable/c/1c12c3117639e78940959d956519c758c57d0849 ↗