Use-after-free vulnerability in Bluetooth btmtksdio driver
Summary
GSD-2022-1003103: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event. Affects Kernel versions >= 9aebfd4a2200ab8075e44379c758bccefdc589bb, < 02ba31e09a26e8cd4582ac8e6163d80284997727. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth btmtksdio driver is a component of the Linux Kernel, which provides support for Bluetooth functionality on devices that use MediaTek SDIO-based Bluetooth controllers. This driver allows communication between the Bluetooth controller and the operating system, enabling features such as wireless audio, file transfer, and device pairing.
Vulnerability Detail
The btmtksdio driver in the Linux Kernel prior to version 5.17.14 is affected by a use-after-free vulnerability. This vulnerability occurs in the btmtksdio_recv_event function, where a reference to a freed memory object is still accessed. An attacker could exploit this vulnerability by sending specially crafted Bluetooth packets, leading to a use-after-free condition. Successful exploitation of this vulnerability could result in arbitrary code execution or a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the official patch or update the Linux Kernel to the fixed version.
Conclusion
The use-after-free vulnerability in the Bluetooth btmtksdio driver of the Linux Kernel can be mitigated by updating to version 5.17.14 or later. It is crucial to promptly apply the recommended patch or update to ensure the security and stability of the system. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
A use-after-free vulnerability occurs when a program continues to reference memory that has already been freed. This can lead to various security issues, including crashes, code execution, or information disclosure.
An attacker can exploit this vulnerability by sending specially crafted Bluetooth packets to the vulnerable system, triggering the use-after-free condition and potentially executing arbitrary code or causing a denial of service.
Yes, this vulnerability was introduced in Linux Kernel version 5.2 by commit 9aebfd4a2200ab8075e44379c758bccefdc589bb and fixed in version 5.17.14 by commit 02ba31e09a26e8cd4582ac8e6163d80284997727.
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system or cause a denial of service, potentially leading to system crashes or unauthorized access.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to promptly apply the necessary updates to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
