In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: Ignore multiple conn complete events
When one of the three connection complete events is received multiple times for the same handle, the device is registered multiple times which leads to memory corruptions. Therefore, consequent events for a single connection are ignored.
The conn->state can hold different values, therefore HCICONNHANDLEUNSET is introduced to identify new connections. To make sure the events do not contain this or another invalid handle HCICONNHANDLEMAX and checks are introduced.
Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497
[ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "signature_version": "v1", "target": { "function": "hci_sync_conn_complete_evt", "file": "net/bluetooth/hci_event.c" }, "digest": { "function_hash": "255099385495767060537327318553896725489", "length": 1673.0 }, "id": "CVE-2022-49138-21ea2b03" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "signature_version": "v1", "target": { "function": "le_conn_complete_evt", "file": "net/bluetooth/hci_event.c" }, "digest": { "function_hash": "74485756832755167313104705232195643500", "length": 2346.0 }, "id": "CVE-2022-49138-7076f7f0" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "signature_version": "v1", "target": { "function": "hci_conn_complete_evt", "file": "net/bluetooth/hci_event.c" }, "digest": { "function_hash": "36069230820029358465647517255598639859", "length": 2297.0 }, "id": "CVE-2022-49138-77c0e0ab" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "signature_version": "v1", "target": { "function": "hci_conn_add", "file": "net/bluetooth/hci_conn.c" }, "digest": { "function_hash": "40270701242638894688314785051213388061", "length": 1988.0 }, "id": "CVE-2022-49138-7f619721" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "signature_version": "v1", "target": { "file": "net/bluetooth/hci_event.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "8466268578494803731532384876197246237", "255138454991144224418688050049668576809", "85470184356688659262676584121123797357", "103955744769443509447591282956148374401", "135534540446765722928441731642235825341", "94005364885370429900013812354675552664", "205954766091802212997232877136468534290", "312925480332989915687308464260808105036", "336358987889840998666113031913746518064", "28534966630142547379148135216434318675", "114858968933096164977198468552701480656", "56812526933843231256915967988400620818", "28669340746509542967850207716244096124", "307600320896372970281800716871962428781", "11491903401192574393967685424257407817", "191484311318486701630339775726989029949", "91440613317901152139315564618176643087", "271955708780604374704092696699791214379", "294981469955173192513438560606928417024", "64525410353671242030862029178873102418", "330133703715617578300017530970636862892", "115212845071305142329616219851768908205", "325703602898051959081805753713351548453", "54123069009325775809131642208023651500" ] }, "id": "CVE-2022-49138-910bb0f6" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "signature_version": "v1", "target": { "file": "net/bluetooth/hci_conn.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "124744057433623752527231037712735335383", "314585544870375986412903357004887795638", "280715265509406953114759078339372177286", "245819685884667054405968016605500400996" ] }, "id": "CVE-2022-49138-9f1b7936" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "signature_version": "v1", "target": { "function": "le_conn_complete_evt", "file": "net/bluetooth/hci_event.c" }, "digest": { "function_hash": "74485756832755167313104705232195643500", "length": 2346.0 }, "id": "CVE-2022-49138-ad844c15" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "signature_version": "v1", "target": { "file": "net/bluetooth/hci_event.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "8466268578494803731532384876197246237", "255138454991144224418688050049668576809", "85470184356688659262676584121123797357", "103955744769443509447591282956148374401", "135534540446765722928441731642235825341", "94005364885370429900013812354675552664", "205954766091802212997232877136468534290", "312925480332989915687308464260808105036", "336358987889840998666113031913746518064", "28534966630142547379148135216434318675", "114858968933096164977198468552701480656", "56812526933843231256915967988400620818", "28669340746509542967850207716244096124", "307600320896372970281800716871962428781", "11491903401192574393967685424257407817", "191484311318486701630339775726989029949", "91440613317901152139315564618176643087", "271955708780604374704092696699791214379", "294981469955173192513438560606928417024", "64525410353671242030862029178873102418", "330133703715617578300017530970636862892", "115212845071305142329616219851768908205", "325703602898051959081805753713351548453", "54123069009325775809131642208023651500" ] }, "id": "CVE-2022-49138-b8bfc98f" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "signature_version": "v1", "target": { "file": "net/bluetooth/hci_conn.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "124744057433623752527231037712735335383", "314585544870375986412903357004887795638", "280715265509406953114759078339372177286", "245819685884667054405968016605500400996" ] }, "id": "CVE-2022-49138-bd2eed85" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "signature_version": "v1", "target": { "function": "hci_sync_conn_complete_evt", "file": "net/bluetooth/hci_event.c" }, "digest": { "function_hash": "255099385495767060537327318553896725489", "length": 1673.0 }, "id": "CVE-2022-49138-c3526fac" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "signature_version": "v1", "target": { "function": "hci_conn_add", "file": "net/bluetooth/hci_conn.c" }, "digest": { "function_hash": "40270701242638894688314785051213388061", "length": 1988.0 }, "id": "CVE-2022-49138-c5141c62" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "signature_version": "v1", "target": { "function": "hci_conn_complete_evt", "file": "net/bluetooth/hci_event.c" }, "digest": { "function_hash": "36069230820029358465647517255598639859", "length": 2297.0 }, "id": "CVE-2022-49138-e312358b" } ]