In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix user-after-free
This uses l2capchanholdunlesszero() after calling _l2capgetchanblah() to prevent the following trace:
Bluetooth: l2capcore.c:static void l2capchan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d
BUG: KASAN: use-after-free in _mutexwaiterisfirst kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in _mutexlockcommon kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in _mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389
{ "vanir_signatures": [ { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e894f950ad48897d1a7cb05909ea29d8c3810e", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-01cc49c5" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c108cf3ad386e0084277093b55a351c49e0be27", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-174666f9" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@843fc4e386dd84b806a7f07fb062d8c3a44e5364", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-1e9ed5ac" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c108cf3ad386e0084277093b55a351c49e0be27", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-2e659862" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e40d6c0823f699d8ad501e48d1c3ae4be386cd", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-31efd6c8" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffde6e03085874ae22263ff4cef4869f797e84f", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-3e9ab043" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91fc2836562f299f34e361e089e9fe154da4f73", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-651494fe" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@843fc4e386dd84b806a7f07fb062d8c3a44e5364", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-6a3a2dc8" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-6ae47ed8" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffde6e03085874ae22263ff4cef4869f797e84f", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-7b15e855" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11e40d6c0823f699d8ad501e48d1c3ae4be386cd", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-7ea24e7f" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91fc2836562f299f34e361e089e9fe154da4f73", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-865aeeb9" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15fc21695eb606bdc5d483b92118ee42610a952d", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-a5095914" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15fc21695eb606bdc5d483b92118ee42610a952d", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-b15a880b" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-dda781d4" }, { "digest": { "line_hashes": [ "164972269744097788755806685541653917893", "215082088971132042825276253350448395559", "248832565119471197345689577274441423551", "323869127114076103596609510743740150942", "43320518491641610632425070146809277239", "230063172898308179876935547217231483635", "260683636548448801804093381627263464186" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45", "signature_type": "Line", "target": { "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-e256ffbf" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e894f950ad48897d1a7cb05909ea29d8c3810e", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-e5de4ecd" }, { "digest": { "length": 1322.0, "function_hash": "26819088210280922824568328599703096850" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f", "signature_type": "Function", "target": { "function": "l2cap_connect_create_rsp", "file": "net/bluetooth/l2cap_core.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2022-50386-f6388d2f" } ] }