CVE-2024-26886
Assigner: Linux
Published: 2024-04-17T10:27:40.941Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: af_bluetooth: Fix deadlock

Attemting to do sock_lock on .recvmsg may cause a deadlock as shown
bellow, so instead of using sock_sock this uses sk_receive_queue.lock
on bt_sock_ioctl to avoid the UAF:

INFO: task kworker/u9:1:121 blocked for more than 30 seconds.
      Not tainted 6.7.6-lemon #183
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __schedule+0x37d/0xa00
 schedule+0x32/0xe0
 __lock_sock+0x68/0xa0
 ? __pfx_autoremove_wake_function+0x10/0x10
 lock_sock_nested+0x43/0x50
 l2cap_sock_recv_cb+0x21/0xa0
 l2cap_recv_frame+0x55b/0x30a0
 ? psi_task_switch+0xeb/0x270
 ? finish_task_switch.isra.0+0x93/0x2a0
 hci_rx_work+0x33a/0x3f0
 process_one_work+0x13a/0x2f0
 worker_thread+0x2f0/0x410
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe0/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1b/0x30
 </TASK>
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 37f71e2c9f51
lessThan: cb8adca52f30
status: affected
versionType: git
version: 1d576c3a5af8
lessThan: 64be3c615488
status: affected
versionType: git
version: 2e07e8348ea4
lessThan: 817e8138ce86
status: affected
versionType: git
version: 2e07e8348ea4
lessThan: 2c9e2df022ef
status: affected
versionType: git
version: 2e07e8348ea4
lessThan: f7b94bdc1ec1
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 6.7
status: affected
version: 0
lessThan: 6.7
status: unaffected
versionType: custom
version: 6.1.83
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.23
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.7.11
lessThanOrEqual: 6.7.*
status: unaffected
versionType: custom
version: 6.8.2
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: Bluetooth: af_bluetooth: Fix deadlock
x_generator: engine: bippy-d175d3acf727