In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix hcisuspendsync crash
If hciunregisterdev() frees the hcidev object but hcisuspendnotifier may still be accessing it, it can cause the program to crash. Here's the call trace: <4>[102152.653246] Call Trace: <4>[102152.653254] hcisuspendsync+0x109/0x301 [bluetooth] <4>[102152.653259] hcisuspenddev+0x78/0xcd [bluetooth] <4>[102152.653263] hcisuspendnotifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifiercallchain+0x43/0x6b <4>[102152.653271] _blockingnotifiercallchain+0x48/0x69 <4>[102152.653273] _pmnotifiercallchain+0x22/0x39 <4>[102152.653276] pmsuspend+0x287/0x57c <4>[102152.653278] statestore+0xae/0xe5 <4>[102152.653281] kernfsfopwrite+0x109/0x173 <4>[102152.653284] _vfswrite+0x16f/0x1a2 <4>[102152.653287] ? selinuxfilepermission+0xca/0x16f <4>[102152.653289] ? securityfilepermission+0x36/0x109 <4>[102152.653291] vfswrite+0x114/0x21d <4>[102152.653293] _x64syswrite+0x7b/0xdb <4>[102152.653296] dosyscall64+0x59/0x194 <4>[102152.653299] entrySYSCALL64after_hwframe+0x5c/0xc1
This patch holds the reference count of the hcidev object while processing it in hcisuspend_notifier to avoid potential crash caused by the race condition.
[
{
"signature_version": "v1",
"digest": {
"length": 483.0,
"function_hash": "331866978352786302699493693003911170829"
},
"id": "CVE-2023-53520-10a1bef6",
"target": {
"file": "net/bluetooth/hci_core.c",
"function": "hci_suspend_notifier"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06e2b5ad72b60f90bfe565c201346532e271f484",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"291507600836763250565660579206556082974",
"149530486916037701920147912212017761847",
"132046996664633393649135565836111620399",
"168297571111958430171272228543736303632",
"117891304786823163507976747014547491384",
"189676659383456245320151514429191253560"
]
},
"id": "CVE-2023-53520-4179eaef",
"target": {
"file": "net/bluetooth/hci_core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9c8ce5d665653e3cf71a76349d41d7a7f7947e6",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"291507600836763250565660579206556082974",
"149530486916037701920147912212017761847",
"132046996664633393649135565836111620399",
"168297571111958430171272228543736303632",
"117891304786823163507976747014547491384",
"189676659383456245320151514429191253560"
]
},
"id": "CVE-2023-53520-729563e7",
"target": {
"file": "net/bluetooth/hci_core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06e2b5ad72b60f90bfe565c201346532e271f484",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 483.0,
"function_hash": "331866978352786302699493693003911170829"
},
"id": "CVE-2023-53520-a9a5b70c",
"target": {
"file": "net/bluetooth/hci_core.c",
"function": "hci_suspend_notifier"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573ebae162111063eedc6c838a659ba628f66a0f",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 483.0,
"function_hash": "331866978352786302699493693003911170829"
},
"id": "CVE-2023-53520-db6ad879",
"target": {
"file": "net/bluetooth/hci_core.c",
"function": "hci_suspend_notifier"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9c8ce5d665653e3cf71a76349d41d7a7f7947e6",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"291507600836763250565660579206556082974",
"149530486916037701920147912212017761847",
"132046996664633393649135565836111620399",
"168297571111958430171272228543736303632",
"117891304786823163507976747014547491384",
"189676659383456245320151514429191253560"
]
},
"id": "CVE-2023-53520-de439ac0",
"target": {
"file": "net/bluetooth/hci_core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573ebae162111063eedc6c838a659ba628f66a0f",
"deprecated": false
}
]