| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-53046: Bluetooth: Fix race condition in hci_cmd_sync_clear |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| Bluetooth: Fix race condition in hci_cmd_sync_clear |
| |
| There is a potential race condition in hci_cmd_sync_work and |
| hci_cmd_sync_clear, and could lead to use-after-free. For instance, |
| hci_cmd_sync_work is added to the 'req_workqueue' after cancel_work_sync |
| The entry of 'cmd_sync_work_list' may be freed in hci_cmd_sync_clear, and |
| causing kernel panic when it is used in 'hci_cmd_sync_work'. |
| |
| Here's the call trace: |
| |
| dump_stack_lvl+0x49/0x63 |
| print_report.cold+0x5e/0x5d3 |
| ? hci_cmd_sync_work+0x282/0x320 |
| kasan_report+0xaa/0x120 |
| ? hci_cmd_sync_work+0x282/0x320 |
| __asan_report_load8_noabort+0x14/0x20 |
| hci_cmd_sync_work+0x282/0x320 |
| process_one_work+0x77b/0x11c0 |
| ? _raw_spin_lock_irq+0x8e/0xf0 |
| worker_thread+0x544/0x1180 |
| ? poll_idle+0x1e0/0x1e0 |
| kthread+0x285/0x320 |
| ? process_one_work+0x11c0/0x11c0 |
| ? kthread_complete_and_exit+0x30/0x30 |
| ret_from_fork+0x22/0x30 |
| </TASK> |
| |
| Allocated by task 266: |
| kasan_save_stack+0x26/0x50 |
| __kasan_kmalloc+0xae/0xe0 |
| kmem_cache_alloc_trace+0x191/0x350 |
| hci_cmd_sync_queue+0x97/0x2b0 |
| hci_update_passive_scan+0x176/0x1d0 |
| le_conn_complete_evt+0x1b5/0x1a00 |
| hci_le_conn_complete_evt+0x234/0x340 |
| hci_le_meta_evt+0x231/0x4e0 |
| hci_event_packet+0x4c5/0xf00 |
| hci_rx_work+0x37d/0x880 |
| process_one_work+0x77b/0x11c0 |
| worker_thread+0x544/0x1180 |
| kthread+0x285/0x320 |
| ret_from_fork+0x22/0x30 |
| |
| Freed by task 269: |
| kasan_save_stack+0x26/0x50 |
| kasan_set_track+0x25/0x40 |
| kasan_set_free_info+0x24/0x40 |
| ____kasan_slab_free+0x176/0x1c0 |
| __kasan_slab_free+0x12/0x20 |
| slab_free_freelist_hook+0x95/0x1a0 |
| kfree+0xba/0x2f0 |
| hci_cmd_sync_clear+0x14c/0x210 |
| hci_unregister_dev+0xff/0x440 |
| vhci_release+0x7b/0xf0 |
| __fput+0x1f3/0x970 |
| ____fput+0xe/0x20 |
| task_work_run+0xd4/0x160 |
| do_exit+0x8b0/0x22a0 |
| do_group_exit+0xba/0x2a0 |
| get_signal+0x1e4a/0x25b0 |
| arch_do_signal_or_restart+0x93/0x1f80 |
| exit_to_user_mode_prepare+0xf5/0x1a0 |
| syscall_exit_to_user_mode+0x26/0x50 |
| ret_from_fork+0x15/0x30 |
| |
| The Linux kernel CVE team has assigned CVE-2023-53046 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.17 with commit 6a98e3836fa2077b169f10a35c2ca9952d53f987 and fixed in 6.1.22 with commit 608901a77c945ac15dea23f6098c9882ef19d9f0 |
| Issue introduced in 5.17 with commit 6a98e3836fa2077b169f10a35c2ca9952d53f987 and fixed in 6.2.9 with commit be586211a3ab40a4f4ca60450e0d31606afc55ec |
| Issue introduced in 5.17 with commit 6a98e3836fa2077b169f10a35c2ca9952d53f987 and fixed in 6.3 with commit 1c66bee492a5fe00ae3fe890bb693bfc99f994c6 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-53046 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/bluetooth/hci_sync.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/608901a77c945ac15dea23f6098c9882ef19d9f0 |
| https://git.kernel.org/stable/c/be586211a3ab40a4f4ca60450e0d31606afc55ec |
| https://git.kernel.org/stable/c/1c66bee492a5fe00ae3fe890bb693bfc99f994c6 |
