In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: Ignore multiple conn complete events
When one of the three connection complete events is received multiple times for the same handle, the device is registered multiple times which leads to memory corruptions. Therefore, consequent events for a single connection are ignored.
The conn->state can hold different values, therefore HCICONNHANDLEUNSET is introduced to identify new connections. To make sure the events do not contain this or another invalid handle HCICONNHANDLEMAX and checks are introduced.
Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497
[
{
"id": "CVE-2022-49138-21ea2b03",
"deprecated": false,
"digest": {
"length": 1673.0,
"function_hash": "255099385495767060537327318553896725489"
},
"target": {
"file": "net/bluetooth/hci_event.c",
"function": "hci_sync_conn_complete_evt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-7076f7f0",
"deprecated": false,
"digest": {
"length": 2346.0,
"function_hash": "74485756832755167313104705232195643500"
},
"target": {
"file": "net/bluetooth/hci_event.c",
"function": "le_conn_complete_evt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-77c0e0ab",
"deprecated": false,
"digest": {
"length": 2297.0,
"function_hash": "36069230820029358465647517255598639859"
},
"target": {
"file": "net/bluetooth/hci_event.c",
"function": "hci_conn_complete_evt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-7f619721",
"deprecated": false,
"digest": {
"length": 1988.0,
"function_hash": "40270701242638894688314785051213388061"
},
"target": {
"file": "net/bluetooth/hci_conn.c",
"function": "hci_conn_add"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-910bb0f6",
"deprecated": false,
"digest": {
"line_hashes": [
"8466268578494803731532384876197246237",
"255138454991144224418688050049668576809",
"85470184356688659262676584121123797357",
"103955744769443509447591282956148374401",
"135534540446765722928441731642235825341",
"94005364885370429900013812354675552664",
"205954766091802212997232877136468534290",
"312925480332989915687308464260808105036",
"336358987889840998666113031913746518064",
"28534966630142547379148135216434318675",
"114858968933096164977198468552701480656",
"56812526933843231256915967988400620818",
"28669340746509542967850207716244096124",
"307600320896372970281800716871962428781",
"11491903401192574393967685424257407817",
"191484311318486701630339775726989029949",
"91440613317901152139315564618176643087",
"271955708780604374704092696699791214379",
"294981469955173192513438560606928417024",
"64525410353671242030862029178873102418",
"330133703715617578300017530970636862892",
"115212845071305142329616219851768908205",
"325703602898051959081805753713351548453",
"54123069009325775809131642208023651500"
],
"threshold": 0.9
},
"target": {
"file": "net/bluetooth/hci_event.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-9f1b7936",
"deprecated": false,
"digest": {
"line_hashes": [
"124744057433623752527231037712735335383",
"314585544870375986412903357004887795638",
"280715265509406953114759078339372177286",
"245819685884667054405968016605500400996"
],
"threshold": 0.9
},
"target": {
"file": "net/bluetooth/hci_conn.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-ad844c15",
"deprecated": false,
"digest": {
"length": 2346.0,
"function_hash": "74485756832755167313104705232195643500"
},
"target": {
"file": "net/bluetooth/hci_event.c",
"function": "le_conn_complete_evt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-b8bfc98f",
"deprecated": false,
"digest": {
"line_hashes": [
"8466268578494803731532384876197246237",
"255138454991144224418688050049668576809",
"85470184356688659262676584121123797357",
"103955744769443509447591282956148374401",
"135534540446765722928441731642235825341",
"94005364885370429900013812354675552664",
"205954766091802212997232877136468534290",
"312925480332989915687308464260808105036",
"336358987889840998666113031913746518064",
"28534966630142547379148135216434318675",
"114858968933096164977198468552701480656",
"56812526933843231256915967988400620818",
"28669340746509542967850207716244096124",
"307600320896372970281800716871962428781",
"11491903401192574393967685424257407817",
"191484311318486701630339775726989029949",
"91440613317901152139315564618176643087",
"271955708780604374704092696699791214379",
"294981469955173192513438560606928417024",
"64525410353671242030862029178873102418",
"330133703715617578300017530970636862892",
"115212845071305142329616219851768908205",
"325703602898051959081805753713351548453",
"54123069009325775809131642208023651500"
],
"threshold": 0.9
},
"target": {
"file": "net/bluetooth/hci_event.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-bd2eed85",
"deprecated": false,
"digest": {
"line_hashes": [
"124744057433623752527231037712735335383",
"314585544870375986412903357004887795638",
"280715265509406953114759078339372177286",
"245819685884667054405968016605500400996"
],
"threshold": 0.9
},
"target": {
"file": "net/bluetooth/hci_conn.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-c3526fac",
"deprecated": false,
"digest": {
"length": 1673.0,
"function_hash": "255099385495767060537327318553896725489"
},
"target": {
"file": "net/bluetooth/hci_event.c",
"function": "hci_sync_conn_complete_evt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-c5141c62",
"deprecated": false,
"digest": {
"length": 1988.0,
"function_hash": "40270701242638894688314785051213388061"
},
"target": {
"file": "net/bluetooth/hci_conn.c",
"function": "hci_conn_add"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2022-49138-e312358b",
"deprecated": false,
"digest": {
"length": 2297.0,
"function_hash": "36069230820029358465647517255598639859"
},
"target": {
"file": "net/bluetooth/hci_event.c",
"function": "hci_conn_complete_evt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed",
"signature_type": "Function",
"signature_version": "v1"
}
]