Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.151, 6.2, 6.11, 6.12.103, 6.18.44, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c · fixed in 64d1645f26aa49b5a86ba2fccd0bb6749ea725a6; From 227a0cdf4a028a73dc256d0f5144b4808d718893 · fixed in 963fb4b8e7d1ab07b4ae45bf15d41e667c88caca; From 227a0cdf4a028a73dc256d0f5144b4808d718893 · fixed in e8f9fef362bab431d95371d3406bc720350290c3; From 227a0cdf4a028a73dc256d0f5144b4808d718893 · fixed in fa812cfa81aa3d4a7b6ce8277979af57b3f79712; From 227a0cdf4a028a73dc256d0f5144b4808d718893 · fixed in 5761d003daa987ac81463f570713ce9c9dd204e5; From 6.6.51 · fixed in 6.6.151; From 6.1.184 · fixed in 6.2; From 6.10.10 · fixed in 6.11
- Linux Linux
6.11
- KernelLinux
fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.11.0 · fixed in 6.18.44; From 6.13.0 · fixed in 7.1.8