CVE-2022-49470: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtksdio: fix use-after-free at btmtksdiorecvevent
We should not access skb buffer data anymore after hcirecvframe was called.
[ 39.634809] BUG: KASAN: use-after-free in btmtksdiorecvevent+0x1b0 [ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [ 39.634962] Call trace: [ 39.634974] dumpbacktrace+0x0/0x3b8 [ 39.634999] showstack+0x20/0x2c [ 39.635016] dumpstacklvl+0x60/0x78 [ 39.635040] printaddressdescription+0x70/0x2f0 [ 39.635062] kasanreport+0x154/0x194 [ 39.635079] asanreportload1noabort+0x44/0x50 [ 39.635099] btmtksdiorecvevent+0x1b0/0x1c4 [ 39.635129] btmtksdiotxrxwork+0x6cc/0xac4 [ 39.635157] processonework+0x560/0xc5c [ 39.635177] workerthread+0x7ec/0xcc0 [ 39.635195] kthread+0x2d0/0x3d0 [ 39.635215] retfromfork+0x10/0x20 [ 39.635247] Allocated by task 0: [ 39.635260] (stack is not available) [ 39.635281] Freed by task 2392: [ 39.635295] kasansavestack+0x38/0x68 [ 39.635319] kasansettrack+0x28/0x3c [ 39.635338] kasansetfreeinfo+0x28/0x4c [ 39.635357] kasanslabfree+0x104/0x150 [ 39.635374] kasanslabfree+0x18/0x28 [ 39.635391] slabfreefreelisthook+0x114/0x248 [ 39.635410] kfree+0xf8/0x2b4 [ 39.635427] skbfreehead+0x58/0x98 [ 39.635447] skbreleasedata+0x2f4/0x410 [ 39.635464] skbreleaseall+0x50/0x60 [ 39.635481] kfreeskb+0xc8/0x25c [ 39.635498] hcieventpacket+0x894/0xca4 [bluetooth] [ 39.635721] hcirxwork+0x1c8/0x68c [bluetooth] [ 39.635925] processonework+0x560/0xc5c [ 39.635951] workerthread+0x7ec/0xcc0 [ 39.635970] kthread+0x2d0/0x3d0 [ 39.635990] retfromfork+0x10/0x20 [ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 which belongs to the cache kmalloc-512 of size 512 [ 39.636039] The buggy address is located 13 bytes inside of 512-byte region [ffffff80cf28a600, ffffff80cf28a800)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49470?
CVE-2022-49470 has a moderate severity level due to the potential for use-after-free vulnerabilities in the Linux kernel's Bluetooth subsystem.
How do I fix CVE-2022-49470?
To fix CVE-2022-49470, update your Linux kernel to a version that includes the necessary patches, specifically versions beyond 5.15.54, 5.17.14, or 5.18.3.
Which versions of the Linux kernel are affected by CVE-2022-49470?
CVE-2022-49470 affects Linux kernel versions from 5.2 up to 5.15.54 and from 5.16 up to 5.17.14, as well as versions up to 5.18.3.
What is the impact of CVE-2022-49470 on system security?
CVE-2022-49470 can lead to potential data corruption or system crashes because of improper memory handling in the Bluetooth subsystem.
Is CVE-2022-49470 exploitable in production environments?
Yes, CVE-2022-49470 can be exploitable in production environments, particularly those utilizing Bluetooth features in affected kernel versions.