In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: FIX possible deadlock in rfcommskstate_change
rfcommskstatechange attempts to use socklock so it must never be called with it locked but rfcommsockioctl always attempt to lock it causing the following trace:
====================================================== WARNING: possible circular locking dependency detected
syz-executor386/5093 is trying to acquire lock: ffff88807c396258 (sklock-AFBLUETOOTH-BTPROTORFCOMM){+.+.}-{0:0}, at: locksock include/net/sock.h:1671 [inline] ffff88807c396258 (sklock-AFBLUETOOTH-BTPROTORFCOMM){+.+.}-{0:0}, at: rfcommskstatechange+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock: ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: _rfcommdlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
[
{
"id": "CVE-2024-50044-1858837c",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"203975455371461736008402037243093988712",
"50667070705654006159554257330289377822",
"125463172679284723416687099837412489444",
"207636697412802443071645918013390620142",
"284066098835626317440291865147422885156",
"202473802085270134485651030803217886897"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08d1914293dae38350b8088980e59fbc699a72fe",
"signature_version": "v1"
},
{
"id": "CVE-2024-50044-277dde2e",
"target": {
"file": "net/bluetooth/rfcomm/sock.c",
"function": "rfcomm_sock_ioctl"
},
"digest": {
"length": 457.0,
"function_hash": "243926522273780704226549064241068141019"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08d1914293dae38350b8088980e59fbc699a72fe",
"signature_version": "v1"
},
{
"id": "CVE-2024-50044-3442f3e2",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"203975455371461736008402037243093988712",
"50667070705654006159554257330289377822",
"125463172679284723416687099837412489444",
"207636697412802443071645918013390620142",
"284066098835626317440291865147422885156",
"202473802085270134485651030803217886897"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@869c6ee62ab8f01bf2419e45326642be5c9b670a",
"signature_version": "v1"
},
{
"id": "CVE-2024-50044-7995a258",
"target": {
"file": "net/bluetooth/rfcomm/sock.c",
"function": "rfcomm_sock_ioctl"
},
"digest": {
"length": 457.0,
"function_hash": "243926522273780704226549064241068141019"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@869c6ee62ab8f01bf2419e45326642be5c9b670a",
"signature_version": "v1"
},
{
"id": "CVE-2024-50044-c2fc9c37",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"203975455371461736008402037243093988712",
"50667070705654006159554257330289377822",
"125463172679284723416687099837412489444",
"207636697412802443071645918013390620142",
"284066098835626317440291865147422885156",
"202473802085270134485651030803217886897"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef44274dae9b0a90d1a97ce8b242a3b8243a7745",
"signature_version": "v1"
},
{
"id": "CVE-2024-50044-c52d6098",
"target": {
"file": "net/bluetooth/rfcomm/sock.c",
"function": "rfcomm_sock_ioctl"
},
"digest": {
"length": 457.0,
"function_hash": "243926522273780704226549064241068141019"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef44274dae9b0a90d1a97ce8b242a3b8243a7745",
"signature_version": "v1"
}
]