CVE-2023-54120: Bluetooth: Fix race condition in hidp_session_thread
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix race condition in hidpsessionthread
There is a potential race condition in hidpsessionthread that may lead to use-after-free. For instance, the timer is active while hidpdeltimer is called in hidpsessionthread(). After hidpsessionput, then 'session' will be freed, causing kernel panic when hidpidletimeout is running.
The solution is to use deltimersync instead of deltimer.
Here is the call trace:
? hidpsessionprobe+0x780/0x780 calltimerfn+0x2d/0x1e0 runtimers.part.0+0x569/0x940 hidpsessionprobe+0x780/0x780 calltimerfn+0x1e0/0x1e0 ktimeget+0x5c/0xf0 lapicnextdeadline+0x2c/0x40 clockeventsprogramevent+0x205/0x320 runtimersoftirq+0xa9/0x1b0 dosoftirq+0x1b9/0x641 irqexitrcu+0xdc/0x190 irqexitrcu+0xe/0x20 sysvecapictimerinterrupt+0xa1/0xc0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In hidp_session_thread(), replace hidp_del_timer behavior that calls del_timer with del_timer_sync to prevent the race condition where the timer remains active and can lead to use-after-free/session-freeing and kernel panic.
Linux kernel Bluetooth HIDP (hidp_session_thread / hidp_del_timer) timer deletion synchronization = use del_timer_sync instead of del_timer
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54120?
CVE-2023-54120 has been classified as a potential security vulnerability due to a race condition in the Linux kernel.
How do I fix CVE-2023-54120?
To fix CVE-2023-54120, update your Linux kernel to the latest version where this vulnerability has been addressed.
What causes CVE-2023-54120?
CVE-2023-54120 is caused by a race condition in the hidp_session_thread leading to a use-after-free scenario.
Which systems are affected by CVE-2023-54120?
CVE-2023-54120 affects systems using vulnerable versions of the Linux kernel with Bluetooth support.
Is CVE-2023-54120 being actively exploited?
As of now, there are no public reports indicating that CVE-2023-54120 is being actively exploited in the wild.