Bluetooth: hci_serdev: call init_rwsem() before p->open() in Kernel
Summary
GSD-2022-1002357: Bluetooth: hci_serdev: call init_rwsem() before p->open(). Affects Kernel versions >= d73e172816652772114827abaa2dbc053eecbbd7, < 7af24ae489f7932f8f6a9786f755578555c110aa. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functions and services to enable the proper functioning of the system. The hci_serdev module in the Kernel is responsible for handling Bluetooth communication over a serial device. It allows Bluetooth devices to connect and communicate with the system. However, a vulnerability has been identified in the hci_serdev module that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the hci_serdev module arises from the failure to call init_rwsem() before p->open(). This omission can lead to a race condition where multiple threads attempt to access the same resource simultaneously, resulting in unexpected behavior or a system crash. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive information, execute arbitrary code, or disrupt the normal functioning of the system. The vulnerability was introduced in version v4.16 of the Kernel and has been fixed in version v4.19.238.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply a patch provided by the Linux Kernel community. The patch involves modifying the hci_serdev module to include the missing call to init_rwsem() before p->open(). Here is an example of the code change:
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -123,6 +123,7 @@ static int hci_serdev_open(struct tty_struct *tty)
struct hci_uart *hu;
int err;
+ init_rwsem(&hu->serdev->lock);
hu = hci_uart_get_proto(tty);
if (!hu)
return -ENODEV;
Conclusion
In conclusion, the hci_serdev module in the Kernel is vulnerable to a race condition due to the missing call to init_rwsem() before p->open(). This vulnerability can be mitigated by updating the Kernel to version v4.19.238 or later. Alternatively, users can apply a patch provided by the Linux Kernel community. It is important to stay vigilant and apply security updates to protect against potential exploits. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow attackers to gain unauthorized access to sensitive information, execute arbitrary code, or disrupt the normal functioning of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
There is no evidence to suggest that this vulnerability has been exploited in the wild. However, it is always recommended to apply security updates and patches to mitigate any potential risks.
Yes, a workaround is available by applying a patch provided by the Linux Kernel community. The patch involves modifying the hci_serdev module to include the missing call to init_rwsem() before p->open(). Please refer to the 'workaround' section for more details.
You can find more information about this vulnerability in the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the vulnerability database maintained by the Cloud Security Alliance (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1002xxx/GSD-2022-1002357.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
