CVE-2022-49474
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
Security Summary
CVE-2022-49474 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically affecting the SCO (Synchronous Connection-Oriented) socket handling in sco_sock_connect() and sco_sock_timeout(). The issue arises from a race condition when connecting the same socket twice consecutively, resulting in two sco_conn objects being created but only one associated with the socket. If the socket is closed before the SCO connection is established, the timer for the dangling sco_conn object is not canceled, leading to a use-after-free when the timer callback accesses the freed socket object. This is confirmed by a kernel call trace involving kasan_report and refcount_inc in sco_sock_timeout().
A local attacker with low privileges can exploit this vulnerability due to its CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must trigger the race by rapidly connecting the same SCO socket twice and closing it before the connection establishes, causing the timer callback to access freed memory. Successful exploitation could result in high confidentiality, integrity, and availability impacts, such as arbitrary code execution, data corruption, or system denial of service.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits, including 36c644c63bfcaee2d3a426f45e89a9cd09799318, 390d82733a953c1fabf3de9c9618091a7a9c90a6, 537f619dea4e3fa8ed1f8f938abffe3615794bcc, 65d347cb39e2e6bd0c2a745ad7c928998ebb0162, and 6f55fac0af3531cf60d11369454c41f5fc81ab3f, which fix the dangling sco_conn and use-after-free issues. Security practitioners should update affected Linux kernels to versions incorporating these fixes and monitor for Bluetooth SCO usage in local environments.
Details
- CWE(s)