In the Linux kernel, the following vulnerability has been resolved:
bluetooth/l2cap: sync sock recv cb and release
The problem occurs between the system call to close the sock and hcirxwork, where the former releases the sock and the latter accesses it without lock protection.
CPU0 CPU1
---- ----
sock_close hci_rx_work
l2cap_sock_release hci_acldata_packet
l2cap_sock_kill l2cap_recv_frame
sk_free l2cap_conless_channel
l2cap_sock_recv_cb
If hcirxwork processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data.
Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb.
Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.
[
{
"digest": {
"function_hash": "156850145620132128597233773832859409410",
"length": 927.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_recv_cb",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e856e124f9ae548572c56b1b70c2255705f8fe",
"id": "CVE-2024-41062-0389a11b"
},
{
"digest": {
"function_hash": "156850145620132128597233773832859409410",
"length": 927.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_recv_cb",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b732449b78183d17178db40be3a4401cf3cd629",
"id": "CVE-2024-41062-33da3277"
},
{
"digest": {
"function_hash": "72171362419770792077228149947788681426",
"length": 285.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_kill",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@605572e64cd9cebb05ed609d96cff05b50d18cdf",
"id": "CVE-2024-41062-5df4ba79"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"3428569873507074642230515918939512900",
"87696498373434410275007170345480521824",
"128279217565627108859806746053399363539",
"142303383581929190538481654583002635952",
"335250784300532625090460693557126563135",
"4315049498142499921109448946222548611",
"180470287468831788258288662316300746241",
"179119495856807920159518991036658689143",
"58991537708732720543490932016550788660",
"222089612390797586611666557549486835388",
"43732244657436007209522587512752146560",
"148457221802065664578757138696670916701",
"126709691600343261641769681464745656824",
"260198369446753160087498703561929485125"
]
},
"signature_type": "Line",
"target": {
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e856e124f9ae548572c56b1b70c2255705f8fe",
"id": "CVE-2024-41062-9074fdc8"
},
{
"digest": {
"function_hash": "72171362419770792077228149947788681426",
"length": 285.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_kill",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e856e124f9ae548572c56b1b70c2255705f8fe",
"id": "CVE-2024-41062-956fd9ca"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"3428569873507074642230515918939512900",
"87696498373434410275007170345480521824",
"128279217565627108859806746053399363539",
"142303383581929190538481654583002635952",
"335250784300532625090460693557126563135",
"4315049498142499921109448946222548611",
"180470287468831788258288662316300746241",
"179119495856807920159518991036658689143",
"58991537708732720543490932016550788660",
"222089612390797586611666557549486835388",
"43732244657436007209522587512752146560",
"148457221802065664578757138696670916701",
"126709691600343261641769681464745656824",
"260198369446753160087498703561929485125"
]
},
"signature_type": "Line",
"target": {
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b732449b78183d17178db40be3a4401cf3cd629",
"id": "CVE-2024-41062-9dc9e012"
},
{
"digest": {
"function_hash": "156850145620132128597233773832859409410",
"length": 927.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_recv_cb",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b803f30ea23e0968b6c8285c42adf0d862ab2bf6",
"id": "CVE-2024-41062-9e1915e9"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"3428569873507074642230515918939512900",
"87696498373434410275007170345480521824",
"128279217565627108859806746053399363539",
"142303383581929190538481654583002635952",
"335250784300532625090460693557126563135",
"4315049498142499921109448946222548611",
"180470287468831788258288662316300746241",
"179119495856807920159518991036658689143",
"58991537708732720543490932016550788660",
"222089612390797586611666557549486835388",
"43732244657436007209522587512752146560",
"148457221802065664578757138696670916701",
"126709691600343261641769681464745656824",
"260198369446753160087498703561929485125"
]
},
"signature_type": "Line",
"target": {
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b803f30ea23e0968b6c8285c42adf0d862ab2bf6",
"id": "CVE-2024-41062-bc257b71"
},
{
"digest": {
"function_hash": "72171362419770792077228149947788681426",
"length": 285.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_kill",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b803f30ea23e0968b6c8285c42adf0d862ab2bf6",
"id": "CVE-2024-41062-c9bc1287"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"3428569873507074642230515918939512900",
"87696498373434410275007170345480521824",
"128279217565627108859806746053399363539",
"142303383581929190538481654583002635952",
"335250784300532625090460693557126563135",
"4315049498142499921109448946222548611",
"180470287468831788258288662316300746241",
"179119495856807920159518991036658689143",
"58991537708732720543490932016550788660",
"222089612390797586611666557549486835388",
"43732244657436007209522587512752146560",
"148457221802065664578757138696670916701",
"126709691600343261641769681464745656824",
"260198369446753160087498703561929485125"
]
},
"signature_type": "Line",
"target": {
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@605572e64cd9cebb05ed609d96cff05b50d18cdf",
"id": "CVE-2024-41062-c9e979b9"
},
{
"digest": {
"function_hash": "156850145620132128597233773832859409410",
"length": 927.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_recv_cb",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@605572e64cd9cebb05ed609d96cff05b50d18cdf",
"id": "CVE-2024-41062-f6c88b41"
},
{
"digest": {
"function_hash": "72171362419770792077228149947788681426",
"length": 285.0
},
"signature_type": "Function",
"target": {
"function": "l2cap_sock_kill",
"file": "net/bluetooth/l2cap_sock.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b732449b78183d17178db40be3a4401cf3cd629",
"id": "CVE-2024-41062-fb6507f8"
}
]