CVE-2022-3619: Linux Kernel Bluetooth l2cap_core.c l2cap_recv_acldata memory leak
A memory leak flaw was found in the Linux kernel’s L2CAP bluetooth functionality. This issue occurs when a user generates malicious packets, triggering the l2caprecvacldata function. This flaw allows a local or bluetooth connection user to potentially crash the system.
Other sources
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2caprecvacldata of the file net/bluetooth/l2capcore.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 97097c85c088e11651146da32a4e1cdb9dfa6193 - Configuration
Prevent the Bluetooth kernel modules from being loaded using system-wide modprobe rules.
Linux kernel Bluetooth system-wide modprobe rules = blocklist Bluetooth kernel modules
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-3619?
CVE-2022-3619 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-3619?
To fix CVE-2022-3619, update to the specified kernel versions provided in the remediation for your Linux distribution.
What components are affected by CVE-2022-3619?
CVE-2022-3619 affects the Bluetooth L2CAP functionality within the Linux kernel.
Can CVE-2022-3619 be exploited remotely?
CVE-2022-3619 requires a local or Bluetooth connection for exploitation, meaning it is not exploitable over the internet.
What are the potential impacts of CVE-2022-3619?
Exploitation of CVE-2022-3619 may lead to a memory leak that can crash the system.