REDHAT-BUG-2492458: Medium severity Linux Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp
l2capecredreconfrsp() calls l2capchandel() without holding l2capchanlock(). Every other l2capchandel() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it.
Add l2capchanhold() and l2capchanlock() before l2capchandel(), and l2capchanunlock() and l2capchanput() after, matching the pattern used in l2capecredconnrsp() and l2capconndel().
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to attempt exploitation?
An attacker needs to act as a remote BLE device and send a crafted L2CAP ECRED reconfiguration response to the affected system.
What runtime condition is needed for the channel-list corruption to occur?
The crafted response must reach the vulnerable deletion path while another thread is iterating the L2CAP channel list.
Is there a documented non-patch mitigation or detection method?
The available information does not provide a workaround, configuration mitigation, or indicator for determining whether exploitation has occurred.