CVE-2022-50447: Bluetooth: hci_conn: Fix crash on hci_create_cis_sync
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciconn: Fix crash on hcicreatecissync
When attempting to connect multiple ISO sockets without using DEFERSETUP may result in the following crash:
BUG: KASAN: null-ptr-deref in hcicreatecissync+0x18b/0x2b0 Read of size 2 at addr 0000000000000036 by task kworker/u3:1/50
CPU: 0 PID: 50 Comm: kworker/u3:1 Not tainted 6.0.0-rc7-02243-gb84a13ff4eda #4373 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014 Workqueue: hci0 hcicmdsyncwork Call Trace: <TASK> dumpstacklvl+0x19/0x27 kasanreport+0xbc/0xf0 ? hcicreatecissync+0x18b/0x2b0 hcicreatecissync+0x18b/0x2b0 ? getlinkmode+0xd0/0xd0 ? wwmutexlockslowpath+0x10/0x10 ? mutexlock+0xe0/0xe0 ? getlinkmode+0xd0/0xd0 hcicmdsyncwork+0x111/0x190 processonework+0x427/0x650 workerthread+0x87/0x750 ? processonework+0x650/0x650 kthread+0x14e/0x180 ? kthreadexit+0x50/0x50 retfromfork+0x22/0x30 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (Bluetooth)to a version that resolves this vulnerability.Fixed in 6.0.0-rc7-02243-gb84a13ff4eda - Compensating control
If you are affected, avoid connecting multiple ISO sockets without using workqueue handling as described in the crash report (this bug triggers during hci_cmd_sync_work / hci_create_cis_sync when multiple ISO sockets are connected).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50447?
CVE-2022-50447 is classified as a high severity vulnerability due to its potential to cause crashes in the Linux kernel.
What systems are affected by CVE-2022-50447?
CVE-2022-50447 affects the Linux kernel, particularly impacting systems utilizing Bluetooth ISO sockets.
How do I fix CVE-2022-50447?
To fix CVE-2022-50447, users should update to the latest stable version of the Linux kernel that includes the patch.
What are the consequences of not addressing CVE-2022-50447?
Not addressing CVE-2022-50447 may lead to system crashes and potential downtime for applications relying on Bluetooth functionality.
How does CVE-2022-50447 exploit the Linux kernel?
CVE-2022-50447 exploits the Linux kernel by triggering a null pointer dereference when creating multiple ISO sockets without DEFER_SETUP.