CVE-2022-49910

HIGH EPSS 7.9%
Published May 1, 20251y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published May 1, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb. 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8). Fix it by keeping a local copy of struct l2cap_ctrl. BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169 Workqueue: hci0 hci_rx_work [bluetooth] Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth ret_from_fork (arch/x86/entry/entry_64.S:306) </TASK> Allocated by task 43169: kasan_save_stack (mm/kasan/common.c:39) __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) __alloc_skb (net/core/skbuff.c:414) l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth process_one_work (kernel/workqueue.c:2289) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:306) Freed by task 27920: kasan_save_stack (mm/kasan/common.c:39) kasan_set_track (mm/kasan/common.c:45) kasan_set_free_info (mm/kasan/generic.c:372) ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328) slab_free_freelist_hook (mm/slub.c:1780) kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553) skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth sock_read_iter (net/socket.c:1087) new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401) vfs_read (fs/read_write.c:482) ksys_read (fs/read_write.c:620) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
7.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 10

VendorProductVersionRange
linuxlinux_kernel*≥3.6  –  <4.9.333
linuxlinux_kernel*≥4.10  –  <4.14.299
linuxlinux_kernel*≥4.15  –  <4.19.265
linuxlinux_kernel*≥4.20  –  <5.4.224
linuxlinux_kernel*≥5.5  –  <5.10.154
linuxlinux_kernel*≥5.11  –  <5.15.78
linuxlinux_kernel*≥5.16  –  <6.0.8
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/03af22e23b96fb7ef75fb7885407ef457e8b403d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3aff8aaca4e36dc8b17eaa011684881a80238966
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4cd094fd5d872862ca278e15b9b51b07e915ef3f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6c7407bfbeafc80a04e6eaedcf34d378532a04f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8278a87bb1eeea94350d675ef961ee5a03341fde
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9a04161244603f502c6e453913e51edd59cb70c1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/dc30e05bb18852303084430c03ca76e69257d9ea
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/03af22e23b96fb7ef75fb7885407ef457e8b403d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3aff8aaca4e36dc8b17eaa011684881a80238966
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4cd094fd5d872862ca278e15b9b51b07e915ef3f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6c7407bfbeafc80a04e6eaedcf34d378532a04f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8278a87bb1eeea94350d675ef961ee5a03341fde
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9a04161244603f502c6e453913e51edd59cb70c1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cb1c012099ef5904cd468bdb8d6fcdfdd9bcb569
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/dc30e05bb18852303084430c03ca76e69257d9ea
    Patch