Bug 2347916 (CVE-2022-49138)

Summary: CVE-2022-49138 kernel: Bluetooth: hci_event: Ignore multiple conn complete events
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dfreiber, drow, jburrell, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
CVE-2022-49138 is a vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the handling of Host Controller Interface (HCI) events. The issue arises when the kernel receives multiple "connection complete" events for the same Bluetooth connection handle. In such cases, the kernel erroneously registers the same device multiple times, leading to memory corruption. This flaw could potentially be exploited to cause system instability or other unintended behaviors.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-26 03:11:16 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: Ignore multiple conn complete events

When one of the three connection complete events is received multiple
times for the same handle, the device is registered multiple times which
leads to memory corruptions. Therefore, consequent events for a single
connection are ignored.

The conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET
is introduced to identify new connections. To make sure the events do not
contain this or another invalid handle HCI_CONN_HANDLE_MAX and checks
are introduced.

Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497
Comment 1 Avinash Hanwate 2025-02-26 12:22:46 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022606-CVE-2022-49138-a241@gregkh/T
Comment 4 Avinash Hanwate 2025-02-26 16:44:05 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022606-CVE-2022-49138-a241@gregkh/T