Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over the list backwards to ensure the links are cleanup before its parents, also it no longer relies on a cursor, instead it always uses the last element since hci_abort_conn_sync is guaranteed to call hci_conn_del. UAF crash log: ================================================================== BUG: KASAN: slab-use-after-free in hci_set_powered_sync (net/bluetooth/hci_sync.c:5424) [bluetooth] Read of size 8 at addr ffff888009d9c000 by task kworker/u9:0/124 CPU: 0 PID: 124 Comm: kworker/u9:0 Tainted: G W 6.5.0-rc1+ #10 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xdd/0x160 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] kasan_report+0xa6/0xe0 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_hci_set_powered_sync+0x10/0x10 [bluetooth] ? __pfx_lock_release+0x10/0x10 ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_cmd_sync_work+0x137/0x220 [bluetooth] process_one_work+0x526/0x9d0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_ra
CVE-2023-53762
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53762
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "182ee45da083db4e3e621541ccf255bfa9652214",
"lessThan": "5e3ee972f185eb7957ce789b3bf13a3cb790f178",
"versionType": "git"
},
{
"status": "affected",
"version": "182ee45da083db4e3e621541ccf255bfa9652214",
"lessThan": "a30c074f0b5b7f909a15c978fbc96a29e2f94e42",
"versionType": "git"
},
{
"status": "affected",
"version": "182ee45da083db4e3e621541ccf255bfa9652214",
"lessThan": "ba3ba53ce1f76fc372b8f918fece4f9b1e41acd4",
"versionType": "git"
},
{
"status": "affected",
"version": "182ee45da083db4e3e621541ccf255bfa9652214",
"lessThan": "94d9ba9f9888b748d4abd2aa1547af56ae85f772",
"versionType": "git"
}
],
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver",
"lessThanOrEqual": "6.4.*"
},
{
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver",
"lessThanOrEqual": "6.5.*"
},
{
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53762
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8218 · Revision 1
- Added to Heist Feed
- Publisher date