Use After Free Vulnerability in Bluetooth: hci_send_acl
Summary
GSD-2022-1002192: Bluetooth: Fix use after free in hci_send_acl. Affects Kernel versions < 3803d896ddd97c7c16689a5381c0960040727647. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is the Linux Kernel, which is a critical component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices and software components. The Bluetooth subsystem in the Linux Kernel enables communication with Bluetooth devices. The vulnerability, identified as GSD-2022-1002192, specifically affects the hci_send_acl function in the Bluetooth stack.
Vulnerability Detail
The vulnerability arises due to a use after free bug in the hci_send_acl function of the Bluetooth stack. This bug can be exploited by an attacker to execute arbitrary code or cause a denial of service by sending specially crafted Bluetooth packets. The use after free bug occurs when the function attempts to access memory that has already been freed, leading to unpredictable behavior and potential security issues. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The use after free vulnerability in the hci_send_acl function of the Bluetooth stack in the Linux Kernel has been identified and fixed in version v5.4.189. Users are advised to update their Linux Kernel to the latest version to mitigate the risk of potential exploits. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and the targeted system. It could potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the use after free bug in the Bluetooth stack.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes the manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
As of now, there is no known exploit for this vulnerability. However, it is always recommended to apply security patches and updates to mitigate the risk of potential exploits.
Yes, this vulnerability can be exploited remotely if the targeted system has Bluetooth functionality exposed to the network. An attacker can send specially crafted Bluetooth packets to exploit the use after free bug in the hci_send_acl function.
If you cannot immediately update the Linux Kernel, it is recommended to disable Bluetooth functionality or restrict its usage to trusted devices only. This can help reduce the attack surface and minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
