Bluetooth hci_sync: Fix queuing commands when HCI_UNREGISTER is set
Summary
GSD-2022-1001082: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set. Affects Kernel versions < 1c69ef84a808676cceb69210addf5df45b741323. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth hci_sync module is a component of the Linux Kernel that handles synchronization between the host and controller for Bluetooth communication. It allows the host to send commands to the controller and receive events and data from the controller. The vulnerability in the hci_sync module arises when the HCI_UNREGISTER flag is set, causing commands to be incorrectly queued. This vulnerability can potentially lead to command execution errors and unexpected behavior in Bluetooth communication.
Vulnerability Detail
The vulnerability in the hci_sync module occurs when the HCI_UNREGISTER flag is set. This flag is used to unregister a synchronization object, but due to a coding error, commands are still being queued even after the object is unregistered. This can result in commands being sent to an unregistered object, leading to command execution errors and potential security issues. The impact of this vulnerability is dependent on the specific commands being sent and the context in which they are executed. It is important to note that the actual impact and attack plausibility have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to update their Linux Kernel to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The Bluetooth hci_sync vulnerability, triggered by the HCI_UNREGISTER flag, can lead to command execution errors and unexpected behavior in Bluetooth communication. It is crucial to update the Linux Kernel to version v5.17.3 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific commands being sent and the context in which they are executed. It can potentially lead to command execution errors and unexpected behavior in Bluetooth communication.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there is no known exploit for this vulnerability. However, it is always recommended to apply security patches and updates to mitigate potential risks.
The remote exploitability of this vulnerability is dependent on the specific context and configuration of the affected system. It is recommended to update the Linux Kernel to the fixed version to mitigate potential risks.
You can find more information about this vulnerability in the GSD-2022-1001082 JSON file available in the GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001082.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
