CVE-2022-49111

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142 Comm: bluetoothd Not tainted 5.17.0-rc5...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < c41de54b0a963e59e4dd04c029a4a6d73f45ef9c, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 643a6c26bd32e339d00ad97b8822b6db009e803c, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 684e505406abaeabe0058e9776f9210bf2747953, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 3803d896ddd97c7c16689a5381c0960040727647, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 2cc803804ec9a296b3156855d6c8c4ca1c6b84be, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < d404765dffdbd8dcd14758695d0c96c52fb2e624, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 4da302b90b96c309987eb9b37c8547f939f042d2, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < b3c2ea1fd444b3bb7b82bfd2c3a45418f85c2502, >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < f63d24baff787e13b723d86fe036f84bdbc35045, >= 3.8, < 4.9.311, >= 4.10 < 4.14.276, >= 4.15 < 4.19.238, >= 4.20 < 5.4.189, >= 5.5 < 5.10.111, >= 5.11 < 5.15.34, >= 5.16 < 5.16.20, >= 5.17 < 5.17.3

Fixed versions

4.9.311, 4.14.276, 4.19.238, 5.4.189, 5.10.111, 5.15.34, 5.16.20, 5.17.3

Technical data

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416