In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix use-after-free in deviceforeach_child()
Syzbot has reported the following KASAN splat:
BUG: KASAN: slab-use-after-free in deviceforeach_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980
CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x100/0x190 ? deviceforeachchild+0x18f/0x1a0 printreport+0x13a/0x4cb ? _virtaddrvalid+0x5e/0x590 ? _physaddr+0xc6/0x150 ? deviceforeachchild+0x18f/0x1a0 kasanreport+0xda/0x110 ? deviceforeachchild+0x18f/0x1a0 ? _pfxdevmemallocnoio+0x10/0x10 deviceforeachchild+0x18f/0x1a0 ? _pfxdeviceforeachchild+0x10/0x10 pmruntimesetmemallocnoio+0xf2/0x180 netdevunregisterkobject+0x1ed/0x270 unregisternetdevicemanynotify+0x123c/0x1d80 ? _mutextrylockcommon+0xde/0x250 ? _pfxunregisternetdevicemanynotify+0x10/0x10 ? tracecontentionend+0xe6/0x140 ? _mutexlock+0x4e7/0x8f0 ? _pfxlockacquire.part.0+0x10/0x10 ? rcuiswatching+0x12/0xc0 ? unregisternetdev+0x12/0x30 unregisternetdevicequeue+0x30d/0x3f0 ? _pfxunregisternetdevicequeue+0x10/0x10 ? _pfxdownwrite+0x10/0x10 unregisternetdev+0x1c/0x30 bnepsession+0x1fb3/0x2ab0 ? _pfxbnepsession+0x10/0x10 ? _pfxlockrelease+0x10/0x10 ? _pfxwokenwakefunction+0x10/0x10 ? _kthreadparkme+0x132/0x200 ? _pfxbnepsession+0x10/0x10 ? kthread+0x13a/0x370 ? _pfxbnepsession+0x10/0x10 kthread+0x2b7/0x370 ? _pfxkthread+0x10/0x10 retfromfork+0x48/0x80 ? _pfxkthread+0x10/0x10 retfromfork_asm+0x1a/0x30 </TASK>
Allocated by task 4974: kasansavestack+0x30/0x50 kasansavetrack+0x14/0x30 _kasankmalloc+0xaa/0xb0 _kmallocnoprof+0x1d1/0x440 hciallocdevpriv+0x1d/0x2820 _vhcicreatedevice+0xef/0x7d0 vhciwrite+0x2c7/0x480 vfswrite+0x6a0/0xfc0 ksyswrite+0x12f/0x260 dosyscall64+0xc7/0x250 entrySYSCALL64after_hwframe+0x77/0x7f
Freed by task 4979: kasansavestack+0x30/0x50 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 _kasanslabfree+0x4f/0x70 kfree+0x141/0x490 hcireleasedev+0x4d9/0x600 bthostrelease+0x6a/0xb0 devicerelease+0xa4/0x240 kobjectput+0x1ec/0x5a0 putdevice+0x1f/0x30 vhcirelease+0x81/0xf0 _fput+0x3f6/0xb30 taskworkrun+0x151/0x250 doexit+0xa79/0x2c30 dogroupexit+0xd5/0x2a0 getsignal+0x1fcd/0x2210 archdosignalorrestart+0x93/0x780 syscallexittousermode+0x140/0x290 dosyscall64+0xd4/0x250 entrySYSCALL64after_hwframe+0x77/0x7f
In 'hciconndelsysfs()', 'deviceunregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53237.json"
}[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5a44f351ca7efd9add9851b218f5353e2224b7",
"id": "CVE-2024-53237-01f0339a",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91e2a2e4d1336333804cd31162984f01ad8cc70f",
"id": "CVE-2024-53237-04e7f72a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6894717a1ea363c5a27010ba604f957c309d282d",
"id": "CVE-2024-53237-065b06c8",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5",
"id": "CVE-2024-53237-06b3d720",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b277bd569bb6a2777f0014f84b4344f444fd49d",
"id": "CVE-2024-53237-0ba1eba7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91e2a2e4d1336333804cd31162984f01ad8cc70f",
"id": "CVE-2024-53237-29241689",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27aabf27fd014ae037cc179c61b0bee7cff55b3d",
"id": "CVE-2024-53237-40e8425d",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5a44f351ca7efd9add9851b218f5353e2224b7",
"id": "CVE-2024-53237-422e4da7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9584c897d1cba6265c78010bbb45ca5722c88bc",
"id": "CVE-2024-53237-538cfe18",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5",
"id": "CVE-2024-53237-54af1aa9",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6894717a1ea363c5a27010ba604f957c309d282d",
"id": "CVE-2024-53237-61cc720c",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f67ca2a80acf8b207240405b7f72d660665d3df",
"id": "CVE-2024-53237-644aac48",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5",
"id": "CVE-2024-53237-69443e5d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f67ca2a80acf8b207240405b7f72d660665d3df",
"id": "CVE-2024-53237-83314059",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9584c897d1cba6265c78010bbb45ca5722c88bc",
"id": "CVE-2024-53237-890c5e23",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27aabf27fd014ae037cc179c61b0bee7cff55b3d",
"id": "CVE-2024-53237-91000fbb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27aabf27fd014ae037cc179c61b0bee7cff55b3d",
"id": "CVE-2024-53237-931778d9",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b277bd569bb6a2777f0014f84b4344f444fd49d",
"id": "CVE-2024-53237-966f980c",
"digest": {
"function_hash": "67284366211058823371728307931459517470",
"length": 388.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "hci_conn_del_sysfs"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b277bd569bb6a2777f0014f84b4344f444fd49d",
"id": "CVE-2024-53237-9a4b3ebc",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6894717a1ea363c5a27010ba604f957c309d282d",
"id": "CVE-2024-53237-9b4c22ab",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f67ca2a80acf8b207240405b7f72d660665d3df",
"id": "CVE-2024-53237-bb19cab0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327020525752495793027408140260166991324",
"136733049015632454937701528180103901451",
"130319700886255619307366941312380551059",
"129785141316232466685583237073427199659",
"331774955186949830481237955158494246231",
"269861074954354852519256455275172278239",
"23866640559604847924355678630614932423",
"222716960595232444707156397101087398472",
"326650092540708548679116848071420415712",
"110744528220821627070665122977792045424",
"245274664461137402972955169498034897727",
"93754137303376585302836017033329610347",
"272450038336513871739415190691117661815"
]
},
"target": {
"file": "net/bluetooth/hci_sysfs.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de5a44f351ca7efd9add9851b218f5353e2224b7",
"id": "CVE-2024-53237-cce728b3",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9584c897d1cba6265c78010bbb45ca5722c88bc",
"id": "CVE-2024-53237-eb7587e2",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91e2a2e4d1336333804cd31162984f01ad8cc70f",
"id": "CVE-2024-53237-fb7a8609",
"digest": {
"function_hash": "31369497881348747979063934600716245762",
"length": 117.0
},
"target": {
"file": "net/bluetooth/hci_sysfs.c",
"function": "__match_tty"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53237.json"