CVE-2022-50386

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inli...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 11e40d6c0823f699d8ad501e48d1c3ae4be386cd, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 843fc4e386dd84b806a7f07fb062d8c3a44e5364, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < d91fc2836562f299f34e361e089e9fe154da4f73, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 0c108cf3ad386e0084277093b55a351c49e0be27, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < d1e894f950ad48897d1a7cb05909ea29d8c3810e, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 6ffde6e03085874ae22263ff4cef4869f797e84f, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 15fc21695eb606bdc5d483b92118ee42610a952d, >= 3df91ea20e744344100b10ae69a17211fcf5b207 < 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f, >= 3.4, < 4.9.331, >= 4.10 < 4.14.296, >= 4.15 < 4.19.262, >= 4.20 < 5.4.220, >= 5.5 < 5.10.150, >= 5.11 < 5.15.75, >= 5.16 < 5.19.17, >= 6.0 < 6.0.3

Fixed versions

4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3

Technical data

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416