In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix user-after-free
This uses l2capchanholdunlesszero() after calling _l2capgetchanblah() to prevent the following trace:
Bluetooth: l2capcore.c:static void l2capchan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d
BUG: KASAN: use-after-free in __mutexwaiteris_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutexlockcommon kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in _mutexlock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50386.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50386.json"
[
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e894f950ad48897d1a7cb05909ea29d8c3810e",
"deprecated": false,
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"id": "CVE-2022-50386-01cc49c5"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c108cf3ad386e0084277093b55a351c49e0be27",
"id": "CVE-2022-50386-174666f9",
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"signature_type": "Function",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@843fc4e386dd84b806a7f07fb062d8c3a44e5364",
"id": "CVE-2022-50386-1e9ed5ac",
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"signature_type": "Function",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c108cf3ad386e0084277093b55a351c49e0be27",
"deprecated": false,
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"id": "CVE-2022-50386-2e659862",
"signature_type": "Line"
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e40d6c0823f699d8ad501e48d1c3ae4be386cd",
"deprecated": false,
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"id": "CVE-2022-50386-31efd6c8"
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffde6e03085874ae22263ff4cef4869f797e84f",
"deprecated": false,
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"id": "CVE-2022-50386-3e9ab043"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91fc2836562f299f34e361e089e9fe154da4f73",
"id": "CVE-2022-50386-651494fe",
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"signature_type": "Function",
"deprecated": false
},
{
"signature_version": "v1",
"id": "CVE-2022-50386-6a3a2dc8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@843fc4e386dd84b806a7f07fb062d8c3a44e5364",
"signature_type": "Line",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45",
"deprecated": false,
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"id": "CVE-2022-50386-6ae47ed8",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffde6e03085874ae22263ff4cef4869f797e84f",
"id": "CVE-2022-50386-7b15e855",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e40d6c0823f699d8ad501e48d1c3ae4be386cd",
"deprecated": false,
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"id": "CVE-2022-50386-7ea24e7f",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2022-50386-865aeeb9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91fc2836562f299f34e361e089e9fe154da4f73",
"signature_type": "Line",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15fc21695eb606bdc5d483b92118ee42610a952d",
"deprecated": false,
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"id": "CVE-2022-50386-a5095914",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15fc21695eb606bdc5d483b92118ee42610a952d",
"id": "CVE-2022-50386-b15a880b",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f",
"deprecated": false,
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"id": "CVE-2022-50386-dda781d4",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45",
"deprecated": false,
"digest": {
"line_hashes": [
"164972269744097788755806685541653917893",
"215082088971132042825276253350448395559",
"248832565119471197345689577274441423551",
"323869127114076103596609510743740150942",
"43320518491641610632425070146809277239",
"230063172898308179876935547217231483635",
"260683636548448801804093381627263464186"
],
"threshold": 0.9
},
"id": "CVE-2022-50386-e256ffbf",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e894f950ad48897d1a7cb05909ea29d8c3810e",
"deprecated": false,
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"id": "CVE-2022-50386-e5de4ecd",
"signature_type": "Function"
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f",
"deprecated": false,
"target": {
"file": "net/bluetooth/l2cap_core.c",
"function": "l2cap_connect_create_rsp"
},
"digest": {
"function_hash": "26819088210280922824568328599703096850",
"length": 1322.0
},
"id": "CVE-2022-50386-f6388d2f"
}
]