Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.114, 6.12, 7.1.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From a58d0f5dac322e16cc75334d000666512341bde5 · fixed in 08ac98f18c8d24cc037858dd6fba2670155e4e84; From dc26097bdb864a0d5955b9a25e43376ffc1af99b · fixed in 876a3e94c70d0859d1dad1c986112d4f0d99eba8; From dc26097bdb864a0d5955b9a25e43376ffc1af99b · fixed in af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c; From 6.12.2 · fixed in 6.12.114; From 6.11.11 · fixed in 6.12
- Linux Linux
6.13
- KernelLinux
fixed in 6.12.114; From 6.13.0 · fixed in 7.1.8