Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27386/
CVE ID: CVE-2024-27387 State: PUBLISHED Published: 2024-09-09T00:00:00.000Z Last Updated: 2025-03-17T15:51:23.576Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_rx_range_done_ind(), there is no input validation check on rtt_id coming from userspace, which can lead to a heap overwrite. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/sup
ps://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27387/
CVE ID: CVE-2024-27388 State: PUBLISHED Published: 2024-05-01T13:05:05.518Z Last Updated: 2025-05-04T09:03:54.661Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364 - https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 - https://git.kernel.org/s
9012e0c1ddc0e42364 - https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 - https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 - https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044 - https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c - https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3 - https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 - https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69 - https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d
CVE ID: CVE-2024-27389 State: PUBLISHED Published: 2024-05-01T13:05:09.224Z Last Updated: 2025-05-04T09:03:55.921Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed Unloading a modular pstore backend with records in pstorefs would trigger the dput() double-drop warning: WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410 Using the combo of d_drop()/dput() (as mentioned in Documentation/filesystems/vfs.rst) isn't the right approach here, and leads to the reference counting problem seen above. Use d_invalidate() and update the code to not bother checking for error codes t
e reference counting problem seen above. Use d_invalidate() and update the code to not bother checking for error codes that can never happen. --- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e - https://git.kernel.org/stable/c/4cdf9006fc095af71da80e9b5f48a32e991b9ed3 - https://git.kernel.org/stable/c/cb9e802e49c24eeb3af35e9e8c04d526f35f112a - https://git.kernel.org/stable/c/340682ed1932b8e3bd0bfc6c31a0c6354eb57cc6 - https://git.kernel.org/stable/c/a43e0fc5e9134a46515de2f2f8d4100b74e50de3
CVE ID: CVE-2024-27390 State: PUBLISHED Published: 2024-05-01T13:05:12.775Z Last Updated: 2025-05-04T09:03:57.158Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()")) I think the synchronize_net() call in ipv6_mc_down() is not needed. Under load, synchronize_net() can last between 200 usec and 5 ms. KASAN seems to agree as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9d159d6637ccce25f879d662a480541ef4ba3a50 - https://git.kernel.org/stable/c/a03ede2282ebbd181bd6f5c38cbfcb5765afcd04 - https://git.kernel.org/stable/c/26d4bac55750d535f1f0b8790dc26daf6089e373 - https://git.kernel.org/stable/c/7eb06ee5921189812e6b4bfe7b0f1e878be16df7 - https://git.kernel.org/stable/c/5da9a218340a2bc804dc4327e5804392e24a0b88 - https://git.kernel.org/stable/c/17ef8efc00b34918b966388b2af0993811895a8c
CVE ID: CVE-2024-27391 State: PUBLISHED Published: 2024-05-01T13:05:16.396Z Last Updated: 2025-05-04T09:03:58.573Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: do not realloc workqueue everytime an interface is added Commit 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"") moved workqueue creation in wilc_netdev_ifc_init in order to set the interface name in the workqueue name. However, while the driver needs only one workqueue, the wilc_netdev_ifc_init is called each time we add an interface over a phy, which in turns overwrite the workqueue with a new one. This can be observed with th
time we add an interface over a phy, which in turns overwrite the workqueue with a new one. This can be observed with the following commands: for i in $(seq 0 10) do iw phy phy0 interface add wlan1 type managed iw dev wlan1 del done ps -eo pid,comm|grep wlan 39 kworker/R-wlan0 98 kworker/R-wlan1 102 kworker/R-wlan1 105 kworker/R-wlan1 108 kworker/R-wlan1 111 kworker/R-wlan1 114 kworker/R-wlan1 117 kworker/R-wlan1 120 kworker/R-wlan1 123 kworker/R-wlan1 126 kworker/R-wlan1 129 kworker/R-wlan1 Fix this leakage by putting back hif_workqueue allocation in wilc_cfg80211_init. Regarding the workqueue name, it is indeed relevant to set it lowercase, however it is not attached to a specific netdev,
garding the workqueue name, it is indeed relevant to set it lowercase, however it is not attached to a specific netdev, so enforcing netdev name in the name is not so relevant. Still, enrich the name with the wiphy name to make it clear which phy is using the workqueue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/515cc676dfbce40d93c92b1ff3c1070e917f4e52 - https://git.kernel.org/stable/c/4041c60a9d543b3ad50225385b072ba68e96166e - https://git.kernel.org/stable/c/90ae293d1d255f622318fce6eeea2e18f9fde5c1 - https://git.kernel.org/stable/c/9ab0c303ccabfd6bdce14432792d41090070008c - https://git.kernel.org/stable/c/328efda
5c1 - https://git.kernel.org/stable/c/9ab0c303ccabfd6bdce14432792d41090070008c - https://git.kernel.org/stable/c/328efda22af81130c2ad981c110518cb29ff2f1d
CVE ID: CVE-2024-27392 State: PUBLISHED Published: 2024-05-01T13:05:20.117Z Last Updated: 2025-05-04T09:04:00.296Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse() When nvme_identify_ns() fails, it frees the pointer to the struct nvme_id_ns before it returns. However, ns_update_nuse() calls kfree() for the pointer even when nvme_identify_ns() fails. This results in KASAN double-free, which was observed with blktests nvme/045 with proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by skipping kfree() when nvme_identify_ns() fails. Additional Analyst
es [1] on the kernel v6.8-rc7. Fix the double-free by skipping kfree() when nvme_identify_ns() fails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/534f9dc7fe495b3f9cc84363898ac50c5a25fccb - https://git.kernel.org/stable/c/8d0d2447394b13fb22a069f0330f9c49b7fff9d3
CVE ID: CVE-2024-27393 State: PUBLISHED Published: 2024-05-09T16:37:07.973Z Last Updated: 2025-05-04T09:04:02.163Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling"). It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_releas
ince v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")). This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks"). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1 - https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6 - https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629 - https://git.kernel.org/stabl
4716b8c6a6a8c6 - https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629 - https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4 - https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f
CVE ID: CVE-2024-27394 State: PUBLISHED Published: 2024-05-09T16:37:11.495Z Last Updated: 2025-05-04T09:04:03.796Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/sta
fe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f - https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb
CVE ID: CVE-2024-27395 State: PUBLISHED Published: 2024-05-09T16:37:15.196Z Last Updated: 2025-05-04T09:04:04.943Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org
y_safe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2db9a8c0a01fa1c762c1e61a13c212c492752994 - https://git.kernel.org/stable/c/589523cf0b384164e445dd5db8d5b1bf97982424 - https://git.kernel.org/stable/c/35880c3fa6f8fe281a19975d2992644588ca33d3 - https://git.kernel.org/stable/c/9048616553c65e750d43846f225843ed745ec0d4 - https://git.kernel.org/stable/c/bca6fa2d9a9f560e6b89fd5190b05cc2f5d422c1 - https://git.kernel.org/stable/c/eaa5e164a2110d2fb9e16c8a29e4501882235137 - https://git.kernel.org/stable/c/edee0758747d7c219e29db9ed1d4eb33e8d32865 - https://git.kernel.org/stable/c/5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2
CVE ID: CVE-2024-27396 State: PUBLISHED Published: 2024-05-09T16:37:18.867Z Last Updated: 2025-05-04T12:55:30.840Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/07b20
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/07b20d0a3dc13fb1adff10b60021a4924498da58 - https://git.kernel.org/stable/c/718df1bc226c383dd803397d7f5d95557eb81ac7 - https://git.kernel.org/stable/c/0caff3e6390f840666b8dc1ecebf985c2ef3f1dd - https://git.kernel.org/stable/c/2e74b3fd6bf542349758f283676dff3660327c07 - https://git.kernel.org/stable/c/25a1c2d4b1fcf938356a9688a96a6456abd44b29 - https://git.kernel.org/stable/c/2aacd4de45477582993f8a8abb9505a06426bfb6 - https://git.kernel.org/stable/c/cd957d1716ec979d8f5bf38fc659aeb9fdaa2474 - https://git.kernel.org/stable/c/f2a904107ee2b647bb7794a1a82b67740d7c8a64
CVE ID: CVE-2024-27397 State: PUBLISHED Published: 2024-05-09T16:37:22.463Z Last Updated: 2025-11-03T21:54:14.579Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished. .lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and
ate, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f8dfda798650241c1692058713ca4fef8e429061 - https://git.kernel.org/stable/c/eaf1a29ea5d7dba8e84e9e9f3b3f47d0cd540bfe - https://git.kernel.org/stable/c/7b17de2a71e56c10335b565cc7ad238e6d984379 - https://git.kernel.org/stable/c/0d40e8cb1d1f56a994cdd2e015af622fdca9ed4d - https://git.ker
c10335b565cc7ad238e6d984379 - https://git.kernel.org/stable/c/0d40e8cb1d1f56a994cdd2e015af622fdca9ed4d - https://git.kernel.org/stable/c/b45176b869673417ace338b87cf9cdb66e2eeb01 - https://git.kernel.org/stable/c/7fa2e2960fff8322ce2ded57b5f8e9cbc450b967 - https://git.kernel.org/stable/c/383182db8d58c4237772ba0764cded4938a235c3 - https://git.kernel.org/stable/c/7395dfacfff65e9938ac0889dafa1ab01e987d15
CVE ID: CVE-2024-27398 State: PUBLISHED Published: 2024-05-13T10:22:26.624Z Last Updated: 2025-05-04T12:55:31.938Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close
pen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_kill | (wait a time) sock_put(sk) //FREE | sco_sock_timeout | sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_addre
ock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg
t_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 9
[ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_sig
90755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755]
f88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] ano ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1b33d55fb7355e27f8c82cd4ecd560f162469249 - https://git.kernel.org/stable/c/3212afd00e3cda790fd0583cb3eaef8f9575a014 - https://git.kernel.org/stable/c/33a6e92161a78c1073d90e27abe28d746feb0a53 - https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bc
table/c/33a6e92161a78c1073d90e27abe28d746feb0a53 - https://git.kernel.org/stable/c/6a18eeb1b3bbc67c20d9609c31dca6a69b4bcde5 - https://git.kernel.org/stable/c/bfab2c1f7940a232cd519e82fff137e308abfd93 - https://git.kernel.org/stable/c/012363cb1bec5f33a7b94629ab2c1086f30280f2 - https://git.kernel.org/stable/c/50c2037fc28df870ef29d9728c770c8955d32178 - https://git.kernel.org/stable/c/483bc08181827fc475643272ffb69c533007e546
CVE ID: CVE-2024-27399 State: PUBLISHED Published: 2024-05-13T10:24:57.045Z Last Updated: 2025-05-04T09:04:11.047Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below: [ 472.074580] =========================================
g will happen. The KASAN report triggered by POC is shown below: [ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308
Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0x
5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [
PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158