CVE-2022-50419

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_register() more than once for any device structure' Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join lib/...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= b219e3ac66183fc9771b94af931fb5fd41d586ec < 4bcefec3636208b4c97536b26014d5935d5c10a0, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 6144423712d570247b8ca26e50a277c30dd13702, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 671fee73e08ff415d36a7c16bdf238927df83884, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 6e85d2ad958c6f034b1b158d904019869dbb3c81, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 7b674dce4162bb46d396586e30e4653427023875, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 3423a50fa018e88aed4c900d59c3c8334d8ad583, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < ef055094df4c10b73cfe67c8d43f9de1fb608a8b, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 1b6c89571f453101251201f0fad1c26f7256e937, >= b219e3ac66183fc9771b94af931fb5fd41d586ec < 448a496f760664d3e2e79466aa1787e6abc922b5, >= 2.6.19, >= 2.6.19 < 4.9.331, >= 4.10 < 4.14.296, >= 4.15 < 4.19.262, >= 4.20 < 5.4.220, >= 5.5 < 5.10.150, >= 5.11 < 5.15.75, >= 5.16 < 5.19.17, >= 6.0 < 6.0.3

Fixed versions

4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415