In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix dangling scoconn and use-after-free in scosock_timeout
Connecting the same socket twice consecutively in scosockconnect() could lead to a race condition where two scoconn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling scoconn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function scosocktimeout() accesses the socket. Here's the call trace:
dumpstack+0x107/0x163 ? refcountinc+0x1c/ printaddressdescription.constprop.0+0x1c/0x47e ? refcountinc+0x1c/0x7b kasanreport+0x13a/0x173 ? refcountinc+0x1c/0x7b checkmemoryregion+0x132/0x139 refcountinc+0x1c/0x7b scosocktimeout+0xb2/0x1ba processonework+0x739/0xbd1 ? canceldelayedwork+0x13f/0x13f ? _rawspinlockinit+0xf0/0xf0 ? tokthread+0x59/0x85 workerthread+0x593/0x70e kthread+0x346/0x35a ? drainworkqueue+0x31a/0x31a ? kthreadbind+0x4b/0x4b retfromfork+0x1f/0x30
[
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-0c1f1d1f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f55fac0af3531cf60d11369454c41f5fc81ab3f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-153a72f7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65d347cb39e2e6bd0c2a745ad7c928998ebb0162"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-1907033a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61dbd7311ab978d8ddac1749a758de4de00374"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-2d10e9f8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@390d82733a953c1fabf3de9c9618091a7a9c90a6"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-2db5c0d1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99df16007f4bbf9abfc3478cb17d10f0d7f8906e"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-3e1f3aac",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@537f619dea4e3fa8ed1f8f938abffe3615794bcc"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-45689c41",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61dbd7311ab978d8ddac1749a758de4de00374"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-53a2ec54",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36c644c63bfcaee2d3a426f45e89a9cd09799318"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-561d7de5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-5f1cdfca",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36c644c63bfcaee2d3a426f45e89a9cd09799318"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-737a1fc8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@537f619dea4e3fa8ed1f8f938abffe3615794bcc"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-80ffc731",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f55fac0af3531cf60d11369454c41f5fc81ab3f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-91e610e6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99df16007f4bbf9abfc3478cb17d10f0d7f8906e"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-bdcc8c44",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9de3dc09e56f8deacd2bdbf4cecb71e11a312405"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-c32bf77c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-c4f755b7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9de3dc09e56f8deacd2bdbf4cecb71e11a312405"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90495797827079792904289439572375224447",
"66591137470218658405456627373273475494",
"100945182260703193790639316459013015338",
"191301409197915656695670155660726338001",
"235148925960550454440896562995006664448",
"256468593363553960503840233650430014852",
"271907409449345322506326125918011183439",
"228304942445643770452919844461270984903",
"37170562933951410156408441418847717948",
"289748283351716222784000241647650174799",
"26673321220594216792495273356229967901",
"26654112802851634388922839033650728725"
]
},
"target": {
"file": "net/bluetooth/sco.c"
},
"signature_version": "v1",
"id": "CVE-2022-49474-c6334fae",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65d347cb39e2e6bd0c2a745ad7c928998ebb0162"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "269999511473334064600876385142241656264",
"length": 867.0
},
"target": {
"file": "net/bluetooth/sco.c",
"function": "sco_sock_connect"
},
"signature_version": "v1",
"id": "CVE-2022-49474-e25bc36a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@390d82733a953c1fabf3de9c9618091a7a9c90a6"
}
]