Bug 1999544 (CVE-2021-3752) - CVE-2021-3752 kernel: possible use-after-free in bluetooth module
Summary: CVE-2021-3752 kernel: possible use-after-free in bluetooth module
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3752
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2004506 2005687 2005688 2005689 2005690 2005691 2005692
Blocks: 1999084 1999567
TreeView+ depends on / blocked
 
Reported: 2021-08-31 09:15 UTC by Marian Rehak
Modified: 2022-06-16 11:23 UTC (History)
44 users (show)

Fixed In Version: kernel 5.15.3
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2022-05-11 09:15:35 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:0679 0 None None None 2022-02-24 20:40:50 UTC
Red Hat Product Errata RHBA-2022:0690 0 None None None 2022-02-28 14:16:39 UTC
Red Hat Product Errata RHBA-2022:0740 0 None None None 2022-03-03 15:57:57 UTC
Red Hat Product Errata RHBA-2022:2229 0 None None None 2022-05-12 11:26:29 UTC
Red Hat Product Errata RHBA-2022:4630 0 None None None 2022-05-18 11:46:15 UTC
Red Hat Product Errata RHBA-2022:4693 0 None None None 2022-05-19 05:10:40 UTC
Red Hat Product Errata RHBA-2022:4969 0 None None None 2022-06-08 18:39:46 UTC
Red Hat Product Errata RHBA-2022:5088 0 None None None 2022-06-16 11:23:03 UTC
Red Hat Product Errata RHSA-2022:0620 0 None None None 2022-02-22 16:58:05 UTC
Red Hat Product Errata RHSA-2022:0622 0 None None None 2022-02-22 17:00:44 UTC
Red Hat Product Errata RHSA-2022:1975 0 None None None 2022-05-10 14:39:28 UTC
Red Hat Product Errata RHSA-2022:1988 0 None None None 2022-05-10 14:45:17 UTC

Description Marian Rehak 2021-08-31 09:15:55 UTC 
Use-after-free may allow local user to partially escalate privileges.
Comment 3 Guilherme de Almeida Suckevicz 2021-09-15 13:18:22 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2004506]
Comment 12 gopal krishna tiwari 2021-12-23 07:52:39 UTC 
Hi Alex ,

Any news on this ? 

Thanks
Gopal
Comment 13 Alex 2021-12-23 08:37:21 UTC 
In reply to comment #12:
> Hi Alex ,
> 
> Any news on this ? 
> 
> Thanks
> Gopal

Hi Gopal,

I see that "Bluetooth: fix use-after-free error in lock_sock_nested()" included to 5.10.84-1:
https://packages.qa.debian.org/l/linux/news/20211209T191708Z.html
, and the newer patch
https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/
looks like reworked older patch
https://lore.kernel.org/lkml/20210714031733.1395549-1-bobo.shaobowang@huawei.com/

Could you please check this and if this is correct, then go on with 
https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/
?

Thank you.
Alex
Comment 14 gopal krishna tiwari 2021-12-23 09:22:42 UTC 
(In reply to Alex from comment #13)
> In reply to comment #12:
> > Hi Alex ,
> > 
> > Any news on this ? 
> > 
> > Thanks
> > Gopal
> 
> Hi Gopal,
> 
> I see that "Bluetooth: fix use-after-free error in lock_sock_nested()"
> included to 5.10.84-1:
> https://packages.qa.debian.org/l/linux/news/20211209T191708Z.html
> , and the newer patch
> https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/
> looks like reworked older patch
> https://lore.kernel.org/lkml/20210714031733.1395549-1-bobo.shaobowang@huawei.
> com/
> 
> Could you please check this and if this is correct, then go on with 
> https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/
> ?
> 
> Thank you.
> Alex

Yeah I see https://lore.kernel.org/lkml/20211115165435.133245729@linuxfoundation.org/ merged to 
5.15 

commit 1bff51ea59a9afb67d2dd78518ab0582a54a472c
Author: Wang ShaoBo <bobo.shaobowang>
Date:   Tue Aug 31 17:35:37 2021 -0700

    Bluetooth: fix use-after-free error in lock_sock_nested()
    
    use-after-free error in lock_sock_nested is reported:
    
    [  179.140137][ T3731] =====================================================
    [  179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0
    [  179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54
    [  179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/0104
    [  179.151806][ T3731] Workqueue: events l2cap_chan_timeout
    [  179.152730][ T3731] Call Trace:
    [  179.153301][ T3731]  dump_stack+0x24c/0x2e0
    [  179.154063][ T3731]  kmsan_report+0xfb/0x1e0
    [  179.154855][ T3731]  __msan_warning+0x5c/0xa0
    [  179.155579][ T3731]  lock_sock_nested+0x280/0x2c0
    [  179.156436][ T3731]  ? kmsan_get_metadata+0x116/0x180

Thanks for the details.

Gopal ..
Comment 16 Justin M. Forbes 2022-01-05 14:40:47 UTC 
This was fixed for Fedora with the 5.15.3 stable kernel updates.
Comment 18 errata-xmlrpc 2022-02-22 16:58:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:0620 https://access.redhat.com/errata/RHSA-2022:0620
Comment 19 errata-xmlrpc 2022-02-22 17:00:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:0622 https://access.redhat.com/errata/RHSA-2022:0622
Comment 20 errata-xmlrpc 2022-05-10 14:39:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975
Comment 21 errata-xmlrpc 2022-05-10 14:45:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
Comment 22 Product Security DevOps Team 2022-05-11 09:15:31 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3752
Note You need to log in before you can comment on or make changes to this bug.