Bluetooth: Fix Dangling sco_conn and Use-After-Free in sco_sock_timeout
Summary
GSD-2022-1003112: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout. Affects Kernel versions >= e1dee2c1de2b4dd00eb44004a4bda6326ed07b59, < 537f619dea4e3fa8ed1f8f938abffe3615794bcc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth vulnerability affects the Linux Kernel, which is a critical component of the Linux operating system. The Linux Kernel is responsible for managing system resources and providing an interface between hardware and software components. Bluetooth is a wireless communication technology commonly used for short-range data exchange between devices. The vulnerability in the sco_sock_timeout function can lead to a dangling sco_conn and a use-after-free condition. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
Vulnerability Detail
The vulnerability originates from a flaw in the sco_sock_timeout function of the Linux Kernel's Bluetooth implementation. It was introduced in version v5.15 of the Linux Kernel and fixed in version v5.17.14. The vulnerability allows for a dangling sco_conn, which can result in a use-after-free condition. An attacker could potentially exploit this vulnerability to execute arbitrary code with kernel privileges or cause a DoS by crashing the system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable Bluetooth functionality on their systems until the Linux Kernel is updated to a version that includes the fix. Disabling Bluetooth can help mitigate the risk of exploitation through this vulnerability. To disable Bluetooth, users can follow the instructions specific to their Linux distribution or use the following command:
$
sudo systemctl disable bluetooth
Conclusion
The Bluetooth vulnerability in the Linux Kernel's sco_sock_timeout function can lead to a dangling sco_conn and a use-after-free condition. It is crucial to update the Linux Kernel to version v5.17.14 or later to mitigate the risk of exploitation. Disabling Bluetooth functionality can serve as a temporary workaround until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and intentions. It could potentially allow an attacker to execute arbitrary code with kernel privileges or cause a denial-of-service condition by crashing the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any open-source vulnerabilities, including this Bluetooth vulnerability, are found.
Yes, a workaround is available. Users can disable Bluetooth functionality on their systems until the Linux Kernel is updated to a version that includes the fix. Disabling Bluetooth can help mitigate the risk of exploitation through this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.17.14 or later. You can follow the instructions specific to your Linux distribution to update the Kernel or refer to the official documentation for your distribution.
At the time of this report, no proof of concept or exploit code has been made publicly available for this vulnerability. However, it is important to apply the recommended fix as soon as possible to protect your system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
