In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix not cleanup led when bt_init fails
btinit() calls btledsinit() to register led, but if it fails later, btleds_cleanup() is not called to unregister it.
This can cause panic if the argument "bluetooth-power" in text is freed and then another ledtriggerregister() tries to access it:
BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> ledtriggerregister+0x10d/0x4f0 ledtriggerregistersimple+0x7d/0x100 btinit+0x39/0xf7 [bluetooth] dooneinitcall+0xd0/0x4e0
[
{
"id": "CVE-2022-48971-1458bd6a",
"signature_version": "v1",
"digest": {
"length": 821.0,
"function_hash": "214237980970358613372193695886027764574"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c6cf0afc3856359e620e96edd952457d258e16c",
"target": {
"file": "net/bluetooth/af_bluetooth.c",
"function": "bt_init"
}
},
{
"id": "CVE-2022-48971-1c1e1c6d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326528708527245174360771043975073696367",
"65099165118149367401995936952352254244",
"246571407074428403251282706178851072564",
"124540536241906625605615659232749307831",
"36595942818564210109804087948154575841",
"153797921668201241689827101069159297464",
"166314789573422405001145853610498835261",
"219610691967376560216310755026134548216"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edf7284a98296369dd0891a0457eec37df244873",
"target": {
"file": "net/bluetooth/af_bluetooth.c"
}
},
{
"id": "CVE-2022-48971-21b171ab",
"signature_version": "v1",
"digest": {
"length": 821.0,
"function_hash": "214237980970358613372193695886027764574"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@edf7284a98296369dd0891a0457eec37df244873",
"target": {
"file": "net/bluetooth/af_bluetooth.c",
"function": "bt_init"
}
},
{
"id": "CVE-2022-48971-2dd616b3",
"signature_version": "v1",
"digest": {
"length": 821.0,
"function_hash": "214237980970358613372193695886027764574"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7b950458156d410509a08c41930b75e72985938",
"target": {
"file": "net/bluetooth/af_bluetooth.c",
"function": "bt_init"
}
},
{
"id": "CVE-2022-48971-331b1c5f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326528708527245174360771043975073696367",
"65099165118149367401995936952352254244",
"246571407074428403251282706178851072564",
"124540536241906625605615659232749307831",
"36595942818564210109804087948154575841",
"153797921668201241689827101069159297464",
"166314789573422405001145853610498835261",
"219610691967376560216310755026134548216"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ecf7cd6fde5e72c87122084cf00d63e35d8dd9f",
"target": {
"file": "net/bluetooth/af_bluetooth.c"
}
},
{
"id": "CVE-2022-48971-3fd2b6de",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326528708527245174360771043975073696367",
"65099165118149367401995936952352254244",
"246571407074428403251282706178851072564",
"124540536241906625605615659232749307831",
"36595942818564210109804087948154575841",
"153797921668201241689827101069159297464",
"166314789573422405001145853610498835261",
"219610691967376560216310755026134548216"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a66c3a94285552f6a8e45d73b34ebbad11d388b",
"target": {
"file": "net/bluetooth/af_bluetooth.c"
}
},
{
"id": "CVE-2022-48971-4f64b29a",
"signature_version": "v1",
"digest": {
"length": 821.0,
"function_hash": "214237980970358613372193695886027764574"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ecf7cd6fde5e72c87122084cf00d63e35d8dd9f",
"target": {
"file": "net/bluetooth/af_bluetooth.c",
"function": "bt_init"
}
},
{
"id": "CVE-2022-48971-6a1d73ed",
"signature_version": "v1",
"digest": {
"length": 821.0,
"function_hash": "214237980970358613372193695886027764574"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a66c3a94285552f6a8e45d73b34ebbad11d388b",
"target": {
"file": "net/bluetooth/af_bluetooth.c",
"function": "bt_init"
}
},
{
"id": "CVE-2022-48971-ea586af7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326528708527245174360771043975073696367",
"65099165118149367401995936952352254244",
"246571407074428403251282706178851072564",
"124540536241906625605615659232749307831",
"36595942818564210109804087948154575841",
"153797921668201241689827101069159297464",
"166314789573422405001145853610498835261",
"219610691967376560216310755026134548216"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c6cf0afc3856359e620e96edd952457d258e16c",
"target": {
"file": "net/bluetooth/af_bluetooth.c"
}
},
{
"id": "CVE-2022-48971-f80f7738",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326528708527245174360771043975073696367",
"65099165118149367401995936952352254244",
"246571407074428403251282706178851072564",
"124540536241906625605615659232749307831",
"36595942818564210109804087948154575841",
"153797921668201241689827101069159297464",
"166314789573422405001145853610498835261",
"219610691967376560216310755026134548216"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7b950458156d410509a08c41930b75e72985938",
"target": {
"file": "net/bluetooth/af_bluetooth.c"
}
}
]