Deadlock Vulnerability in Bluetooth Package
Summary
GSD-2021-1000366: Bluetooth: avoid deadlock between hci_dev->lock and socket lock. Affects Kernel versions >= eab2404ba798a8efda2a970f44071c3406d94e57, < 7cc0ba67883c6c8d3bddb283f56c167fc837a555. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package is a component of the Linux Kernel, which is responsible for managing Bluetooth devices and communication. It provides the necessary drivers and protocols for Bluetooth functionality on Linux-based systems. The package allows users to connect and interact with various Bluetooth devices, such as headphones, keyboards, and speakers. However, a vulnerability has been discovered in the Bluetooth package that can lead to a deadlock situation between the hci_dev->lock and socket lock.
Vulnerability Detail
The identified vulnerability in the Bluetooth package can result in a deadlock scenario between the hci_dev->lock and socket lock. This deadlock can occur when multiple threads or processes attempt to acquire these locks simultaneously, leading to a system freeze or unresponsiveness. The vulnerability was introduced in version v5.7 of the Linux Kernel and was fixed in version v5.10.37. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.37 or later. This update includes the necessary patch to address the deadlock issue. Users can obtain the updated Kernel from the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The identified deadlock vulnerability in the Bluetooth package of the Linux Kernel can lead to system freezes or unresponsiveness. It is crucial to update the Linux Kernel to version v5.10.37 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can result in a system freeze or unresponsiveness due to a deadlock situation between the hci_dev->lock and socket lock.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this Bluetooth deadlock vulnerability.
At the time of this report, no known exploits for this vulnerability have been identified. However, it is always recommended to apply security updates promptly to mitigate any potential risks.
While it is technically possible to manually patch the Bluetooth package, it is highly recommended to update the entire Linux Kernel to the fixed version v5.10.37 or later. This ensures that all related components and dependencies are properly updated and aligned.
No, this vulnerability specifically affects the Bluetooth package in the Linux Kernel. It is recommended to update to the fixed version rather than seeking alternative packages.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.