cve/published/2022/CVE-2022-49910.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-1.1.0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@kernel.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2022-49910: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

 Fix the race condition between the following two flows that run in
 parallel:

 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) ->
    __sock_queue_rcv_skb.

 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram.

 An SKB can be queued by the first flow and immediately dequeued and
 freed by the second flow, therefore the callers of l2cap_reassemble_sdu
 can't use the SKB after that function returns. However, some places
 continue accessing struct l2cap_ctrl that resides in the SKB's CB for a
 short time after l2cap_reassemble_sdu returns, leading to a
 use-after-free condition (the stack trace is below, line numbers for
 kernel 5.19.8).

 Fix it by keeping a local copy of struct l2cap_ctrl.

 BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
 Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169

 Workqueue: hci0 hci_rx_work [bluetooth]
 Call Trace:
  <TASK>
  dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
  print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429)
  ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
  kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493)
  ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
  l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
  l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth
  ret_from_fork (arch/x86/entry/entry_64.S:306)
  </TASK>

 Allocated by task 43169:
  kasan_save_stack (mm/kasan/common.c:39)
  __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)
  kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293)
  __alloc_skb (net/core/skbuff.c:414)
  l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth
  l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth
  hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth
  process_one_work (kernel/workqueue.c:2289)
  worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437)
  kthread (kernel/kthread.c:376)
  ret_from_fork (arch/x86/entry/entry_64.S:306)

 Freed by task 27920:
  kasan_save_stack (mm/kasan/common.c:39)
  kasan_set_track (mm/kasan/common.c:45)
  kasan_set_free_info (mm/kasan/generic.c:372)
  ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328)
  slab_free_freelist_hook (mm/slub.c:1780)
  kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553)
  skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323)
  bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth
  l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth
  sock_read_iter (net/socket.c:1087)
  new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401)
  vfs_read (fs/read_write.c:482)
  ksys_read (fs/read_write.c:620)
  do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)

 The Linux kernel CVE team has assigned CVE-2022-49910 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.9.333 with commit dc30e05bb18852303084430c03ca76e69257d9ea
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.14.299 with commit 03af22e23b96fb7ef75fb7885407ef457e8b403d
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.19.265 with commit 6c7407bfbeafc80a04e6eaedcf34d378532a04f2
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.4.224 with commit 4cd094fd5d872862ca278e15b9b51b07e915ef3f
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.10.154 with commit cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.15.78 with commit 8278a87bb1eeea94350d675ef961ee5a03341fde
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 6.0.8 with commit 9a04161244603f502c6e453913e51edd59cb70c1
 	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 6.1 with commit 3aff8aaca4e36dc8b17eaa011684881a80238966

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2022-49910
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	net/bluetooth/l2cap_core.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/dc30e05bb18852303084430c03ca76e69257d9ea
 	https://git.kernel.org/stable/c/03af22e23b96fb7ef75fb7885407ef457e8b403d
 	https://git.kernel.org/stable/c/6c7407bfbeafc80a04e6eaedcf34d378532a04f2
 	https://git.kernel.org/stable/c/4cd094fd5d872862ca278e15b9b51b07e915ef3f
 	https://git.kernel.org/stable/c/cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569
 	https://git.kernel.org/stable/c/8278a87bb1eeea94350d675ef961ee5a03341fde
 	https://git.kernel.org/stable/c/9a04161244603f502c6e453913e51edd59cb70c1
 	https://git.kernel.org/stable/c/3aff8aaca4e36dc8b17eaa011684881a80238966
	From bippy-1.1.0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@kernel.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2022-49910: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

	Fix the race condition between the following two flows that run in
	parallel:

	1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) ->
	__sock_queue_rcv_skb.

	2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram.

	An SKB can be queued by the first flow and immediately dequeued and
	freed by the second flow, therefore the callers of l2cap_reassemble_sdu
	can't use the SKB after that function returns. However, some places
	continue accessing struct l2cap_ctrl that resides in the SKB's CB for a
	short time after l2cap_reassemble_sdu returns, leading to a
	use-after-free condition (the stack trace is below, line numbers for
	kernel 5.19.8).

	Fix it by keeping a local copy of struct l2cap_ctrl.

	BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
	Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169

	Workqueue: hci0 hci_rx_work [bluetooth]
	Call Trace:
	<TASK>
	dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
	print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429)
	? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
	kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493)
	? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
	l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth
	l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth
	ret_from_fork (arch/x86/entry/entry_64.S:306)
	</TASK>

	Allocated by task 43169:
	kasan_save_stack (mm/kasan/common.c:39)
	__kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)
	kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293)
	__alloc_skb (net/core/skbuff.c:414)
	l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth
	l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth
	hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth
	process_one_work (kernel/workqueue.c:2289)
	worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437)
	kthread (kernel/kthread.c:376)
	ret_from_fork (arch/x86/entry/entry_64.S:306)

	Freed by task 27920:
	kasan_save_stack (mm/kasan/common.c:39)
	kasan_set_track (mm/kasan/common.c:45)
	kasan_set_free_info (mm/kasan/generic.c:372)
	____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328)
	slab_free_freelist_hook (mm/slub.c:1780)
	kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553)
	skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323)
	bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth
	l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth
	sock_read_iter (net/socket.c:1087)
	new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401)
	vfs_read (fs/read_write.c:482)
	ksys_read (fs/read_write.c:620)
	do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)

	The Linux kernel CVE team has assigned CVE-2022-49910 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.9.333 with commit dc30e05bb18852303084430c03ca76e69257d9ea
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.14.299 with commit 03af22e23b96fb7ef75fb7885407ef457e8b403d
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 4.19.265 with commit 6c7407bfbeafc80a04e6eaedcf34d378532a04f2
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.4.224 with commit 4cd094fd5d872862ca278e15b9b51b07e915ef3f
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.10.154 with commit cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 5.15.78 with commit 8278a87bb1eeea94350d675ef961ee5a03341fde
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 6.0.8 with commit 9a04161244603f502c6e453913e51edd59cb70c1
	Issue introduced in 3.6 with commit 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 and fixed in 6.1 with commit 3aff8aaca4e36dc8b17eaa011684881a80238966

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49910
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	net/bluetooth/l2cap_core.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/dc30e05bb18852303084430c03ca76e69257d9ea
	https://git.kernel.org/stable/c/03af22e23b96fb7ef75fb7885407ef457e8b403d
	https://git.kernel.org/stable/c/6c7407bfbeafc80a04e6eaedcf34d378532a04f2
	https://git.kernel.org/stable/c/4cd094fd5d872862ca278e15b9b51b07e915ef3f
	https://git.kernel.org/stable/c/cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569
	https://git.kernel.org/stable/c/8278a87bb1eeea94350d675ef961ee5a03341fde
	https://git.kernel.org/stable/c/9a04161244603f502c6e453913e51edd59cb70c1
	https://git.kernel.org/stable/c/3aff8aaca4e36dc8b17eaa011684881a80238966