REDHAT-BUG-2419838: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: Fix UAF in hcidisconnectallsync
Use-after-free can occur in hcidisconnectallsync if a connection is deleted by concurrent processing of a controller event.
To prevent this the code now tries to iterate over the list backwards to ensure the links are cleanup before its parents, also it no longer relies on a cursor, instead it always uses the last element since hciabortconnsync is guaranteed to call hciconndel.
UAF crash log: ================================================================== BUG: KASAN: slab-use-after-free in hcisetpoweredsync (net/bluetooth/hcisync.c:5424) [bluetooth] Read of size 8 at addr ffff888009d9c000 by task kworker/u9:0/124
CPU: 0 PID: 124 Comm: kworker/u9:0 Tainted: G W 6.5.0-rc1+ #10 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hcicmdsyncwork [bluetooth] Call Trace: <TASK> dumpstacklvl+0x5b/0x90 printreport+0xcf/0x670 ? virtaddrvalid+0xdd/0x160 ? hcisetpoweredsync+0x2c9/0x4a0 [bluetooth] kasanreport+0xa6/0xe0 ? hcisetpoweredsync+0x2c9/0x4a0 [bluetooth] ? pfxsetpoweredsync+0x10/0x10 [bluetooth] hcisetpoweredsync+0x2c9/0x4a0 [bluetooth] ? pfxhcisetpoweredsync+0x10/0x10 [bluetooth] ? pfxlockrelease+0x10/0x10 ? pfxsetpoweredsync+0x10/0x10 [bluetooth] hcicmdsyncwork+0x137/0x220 [bluetooth] processonework+0x526/0x9d0 ? pfxprocessonework+0x10/0x10 ? pfxdorawspinlock+0x10/0x10 ? markheldlocks+0x1a/0x90 workerthread+0x92/0x630 ? pfxworkerthread+0x10/0x10 kthread+0x196/0x1e0 ? pfxkthread+0x10/0x10 retfromfork+0x2c/0x50 </TASK>
Allocated by task 1782: kasansavestack+0x33/0x60 kasansettrack+0x25/0x30 kasankmalloc+0x8f/0xa0 hciconnadd+0xa5/0xa80 [bluetooth] hcibindcis+0x881/0x9b0 [bluetooth] isoconnectcis+0x121/0x520 [bluetooth] isosockconnect+0x3f6/0x790 [bluetooth] sysconnect+0x109/0x130 x64sysconnect+0x40/0x50 dosyscall64+0x60/0x90 entrySYSCALL64afterhwframe+0x6e/0xd8
Freed by task 695: kasansavestack+0x33/0x60 kasansettrack+0x25/0x30 kasansavefreeinfo+0x2b/0x50 kasanslabfree+0x10a/0x180 kmemcachefree+0x14d/0x2e0 devicerelease+0x5d/0xf0 kobjectput+0xdf/0x270 hcidisconncompleteevt+0x274/0x3a0 [bluetooth] hcieventpacket+0x579/0x7e0 [bluetooth] hcirxwork+0x287/0xaa0 [bluetooth] processonework+0x526/0x9d0 workerthread+0x92/0x630 kthread+0x196/0x1e0 retfromfork+0x2c/0x50 ==================================================================
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.5.0-rc1+ - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch hci_sync: Fix UAF in hci_disconnect_all_sync
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The use-after-free can occur when hci_disconnect_all_sync runs while concurrent processing of a Bluetooth controller event deletes a connection. The provided crash trace shows this happening in Bluetooth HCI command synchronization work.
What is the practical impact?
The reported outcome is a kernel slab use-after-free, detected by KASAN, which can cause a crash. The advisory data classifies the issue as medium severity and identifies it as CWE-416: Use After Free.
Which remediation is described?
The fix changes connection cleanup to iterate backward so links are cleaned up before their parent connections. It also stops relying on a cursor and instead uses the last list element because hci_abort_conn_sync is guaranteed to delete the connection.