In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free caused by l2capreassemblesdu
Fix the race condition between the following two flows that run in parallel:
l2capreassemblesdu -> chan->ops->recv (l2capsockrecvcb) -> _sockqueuercv_skb.
btsockrecvmsg -> skbrecvdatagram, skbfreedatagram.
An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2capreassemblesdu can't use the SKB after that function returns. However, some places continue accessing struct l2capctrl that resides in the SKB's CB for a short time after l2capreassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8).
Fix it by keeping a local copy of struct l2cap_ctrl.
BUG: KASAN: use-after-free in l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169
Workqueue: hci0 hcirxwork [bluetooth] Call Trace: <TASK> dumpstacklvl (lib/dumpstack.c:107 (discriminator 4)) printreport.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth kasanreport (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth l2caprx (net/bluetooth/l2capcore.c:7236 net/bluetooth/l2capcore.c:7271) bluetooth retfromfork (arch/x86/entry/entry_64.S:306) </TASK>
Allocated by task 43169: kasansavestack (mm/kasan/common.c:39) _kasanslaballoc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmemcacheallocnode (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) _allocskb (net/core/skbuff.c:414) l2caprecvfrag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2capcore.c:8329) bluetooth l2caprecvacldata (net/bluetooth/l2capcore.c:8442) bluetooth hcirxwork (net/bluetooth/hcicore.c:3642 net/bluetooth/hcicore.c:3832) bluetooth processonework (kernel/workqueue.c:2289) workerthread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) retfromfork (arch/x86/entry/entry64.S:306)
Freed by task 27920: kasansavestack (mm/kasan/common.c:39) kasansettrack (mm/kasan/common.c:45) kasansetfreeinfo (mm/kasan/generic.c:372) __kasanslabfree (mm/kasan/common.c:368 mm/kasan/common.c:328) slabfreefreelisthook (mm/slub.c:1780) kmemcachefree (mm/slub.c:3536 mm/slub.c:3553) skbfreedatagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) btsockrecvmsg (net/bluetooth/afbluetooth.c:295) bluetooth l2capsockrecvmsg (net/bluetooth/l2capsock.c:1212) bluetooth sockreaditer (net/socket.c:1087) newsyncread (./include/linux/fs.h:2052 fs/readwrite.c:401) vfsread (fs/readwrite.c:482) ksysread (fs/readwrite.c:620) dosyscall64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:120)
[
{
"id": "CVE-2022-49910-12a42467",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc30e05bb18852303084430c03ca76e69257d9ea",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"241072923593906884649403451083853272247",
"149364024132944624378157614865001245043",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-12d00ec5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc30e05bb18852303084430c03ca76e69257d9ea",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-18984ae7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aff8aaca4e36dc8b17eaa011684881a80238966",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "163266009403820652588457019353992878624"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-1f140d2f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"241072923593906884649403451083853272247",
"149364024132944624378157614865001245043",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-20eb042c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a04161244603f502c6e453913e51edd59cb70c1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "163266009403820652588457019353992878624"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-28e6782c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-384a4285",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a04161244603f502c6e453913e51edd59cb70c1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-3ab2a143",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cd094fd5d872862ca278e15b9b51b07e915ef3f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"241072923593906884649403451083853272247",
"149364024132944624378157614865001245043",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-4b003c1d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03af22e23b96fb7ef75fb7885407ef457e8b403d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "205636019070719799606271177273930930911"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-542ab3d4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cd094fd5d872862ca278e15b9b51b07e915ef3f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-57ec1a41",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c7407bfbeafc80a04e6eaedcf34d378532a04f2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "205636019070719799606271177273930930911"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-5ed76b11",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aff8aaca4e36dc8b17eaa011684881a80238966",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"216896523287983948447700041734617894309",
"177655341273346628803018110378687959519",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-6f197592",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03af22e23b96fb7ef75fb7885407ef457e8b403d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"241072923593906884649403451083853272247",
"149364024132944624378157614865001245043",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-87323138",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8278a87bb1eeea94350d675ef961ee5a03341fde",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "163266009403820652588457019353992878624"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-8a467548",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c7407bfbeafc80a04e6eaedcf34d378532a04f2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-bf4c4796",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8278a87bb1eeea94350d675ef961ee5a03341fde",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"216896523287983948447700041734617894309",
"177655341273346628803018110378687959519",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-bfdb617f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c7407bfbeafc80a04e6eaedcf34d378532a04f2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"241072923593906884649403451083853272247",
"149364024132944624378157614865001245043",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-ca67a037",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aff8aaca4e36dc8b17eaa011684881a80238966",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-cd8436be",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "205636019070719799606271177273930930911"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-d39dffca",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8278a87bb1eeea94350d675ef961ee5a03341fde",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-d8358b7c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03af22e23b96fb7ef75fb7885407ef457e8b403d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 2683.0,
"function_hash": "122185887771451880074643688887005180697"
},
"target": {
"function": "l2cap_rx_state_recv",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-d8914f7d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a04161244603f502c6e453913e51edd59cb70c1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149919753523918158404596951782802582134",
"147807092972103542365328204910743105062",
"258266802453498181692962077038001835771",
"222231233189547302606628864362580432342",
"117811832212578924071534118911680155592",
"79608398056329388626921221616987056773",
"108053695610823081722391375256222658683",
"221618922191811301937857170327709297006",
"330335848209310551820467348568324751164",
"28680925863819828034895116271519019209",
"97999172580076778514916794282585607958",
"127711027123925503674094730775196826258",
"52480269490168424349001531185308174787",
"308112154974435237028272316151627613680",
"307728949615634994502393690867391553497",
"248916662058652186452461395784904399925",
"109937760330841653910971345029651274149",
"199086450498334596165055757525367731571",
"101738219605133392774136889890140127358",
"122397852952172083182335093740436544921",
"297156005731215935267554700100202412827",
"216896523287983948447700041734617894309",
"177655341273346628803018110378687959519",
"158721601201526320843686739425977840802",
"83026351936176884407621716330792222927",
"193860338146529992211749875245502582950",
"306377214674104645587249255509915580183",
"325140984119492279552330427984003433950"
]
},
"target": {
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-eadd772e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc30e05bb18852303084430c03ca76e69257d9ea",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "205636019070719799606271177273930930911"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
},
{
"id": "CVE-2022-49910-eb124783",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cd094fd5d872862ca278e15b9b51b07e915ef3f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 807.0,
"function_hash": "205636019070719799606271177273930930911"
},
"target": {
"function": "l2cap_stream_rx",
"file": "net/bluetooth/l2cap_core.c"
}
}
]