CVE-2022-49910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

Fix the race condition between the following two flows that run in

parallel:

1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) ->

__sock_queue_rcv_skb.

2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram.

An SKB can be queued by the first flow and immediately dequeued and

freed by the second flow, therefore the callers of l2cap_reassemble_sdu

can't use the SKB after that function returns. However, some places

continue accessing struct l2cap_ctrl that resides in the SKB's CB for a

short time after l2cap_reassemble_sdu returns, leading to a

use-after-free condition (the stack trace is below, line numbers for

kernel 5.19.8).

Fix it by keeping a local copy of struct l2cap_ctrl.

BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth

Read of size 1 at addr ffff88812025f2f0 by task kworker/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References