Bluetooth: hci_serdev: call init_rwsem() before p->open() - Kernel
Summary
GSD-2022-1002255: Bluetooth: hci_serdev: call init_rwsem() before p->open(). Affects Kernel versions >= d73e172816652772114827abaa2dbc053eecbbd7, < d58d281d6a3f49ce83b82f8211c396ba34c0304f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and manages system resources. It includes various subsystems, including Bluetooth, which enables wireless communication between devices. The hci_serdev module in the Kernel is responsible for handling Bluetooth HCI (Host Controller Interface) communication over a serial device. This vulnerability specifically affects the hci_serdev module and its initialization process.
Vulnerability Detail
The vulnerability arises from a missing call to init_rwsem() before p->open() in the hci_serdev module. This omission can lead to a race condition where multiple threads or processes attempt to access the same resource simultaneously, potentially resulting in data corruption, crashes, or privilege escalation. An attacker could exploit this vulnerability by triggering the race condition and executing arbitrary code or gaining elevated privileges. The vulnerability was introduced in version v4.16 of the Linux Kernel and is fixed in version v5.4.189.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected hci_serdev module by blacklisting it. This can be achieved by adding the module name to the blacklist configuration file (/etc/modprobe.d/blacklist.conf) or by using the modprobe command with the '-b' option. However, this workaround will disable Bluetooth HCI communication over serial devices entirely.
Conclusion
The Bluetooth: hci_serdev: call init_rwsem() before p->open() vulnerability in the Kernel's hci_serdev module can lead to data corruption, crashes, or privilege escalation. It is crucial to update the Linux Kernel to version v5.4.189 or later to fix this vulnerability. Alternatively, users can mitigate the issue by blacklisting the hci_serdev module, although this will disable Bluetooth HCI communication over serial devices entirely. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to data corruption, crashes, or privilege escalation. An attacker could exploit it to execute arbitrary code or gain elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch is available in version v5.4.189 of the Linux Kernel. It is recommended to update to this version or a later one to fix the vulnerability.
Yes, you can mitigate the vulnerability by blacklisting the hci_serdev module. However, this will disable Bluetooth HCI communication over serial devices entirely.
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the necessary updates or workarounds to ensure system security.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
