CVE-2023-54164

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: fix iso_conn related locking and validity issues<br /> <br /> sk-&gt;sk_state indicates whether iso_pi(sk)-&gt;conn is valid. Operations<br /> that check/update sk_state and access conn should hold lock_sock,<br /> otherwise they can race.<br /> <br /> The order of taking locks is hci_dev_lock &gt; lock_sock &gt; iso_conn_lock,<br /> which is how it is in connect/disconnect_cfm -&gt; iso_conn_del -&gt;<br /> iso_chan_del.<br /> <br /> Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock<br /> around updating sk_state and conn.<br /> <br /> iso_conn_del must not occur during iso_connect_cis/bis, as it frees the<br /> iso_conn. Hold hdev-&gt;lock longer to prevent that.<br /> <br /> This should not reintroduce the issue fixed in commit 241f51931c35<br /> ("Bluetooth: ISO: Avoid circular locking dependency"), since the we<br /> acquire locks in order. We retain the fix in iso_sock_connect to release<br /> lock_sock before iso_connect_* acquires hdev-&gt;lock.<br /> <br /> Similarly for commit 6a5ad251b7cd ("Bluetooth: ISO: Fix possible<br /> circular locking dependency"). We retain the fix in iso_conn_ready to<br /> not acquire iso_conn_lock before lock_sock.<br /> <br /> iso_conn_add shall return iso_conn with valid hcon. Make it so also when<br /> reusing an old CIS connection waiting for disconnect timeout (see<br /> __iso_sock_close where conn-&gt;hcon is set to NULL).<br /> <br /> Trace with iso_conn_del after iso_chan_add in iso_connect_cis:<br /> ===============================================================<br /> iso_sock_create:771: sock 00000000be9b69b7<br /> iso_sock_init:693: sk 000000004dff667e<br /> iso_sock_bind:827: sk 000000004dff667e 70:1a:b8:98:ff:a2 type 1<br /> iso_sock_setsockopt:1289: sk 000000004dff667e<br /> iso_sock_setsockopt:1289: sk 000000004dff667e<br /> iso_sock_setsockopt:1289: sk 000000004dff667e<br /> iso_sock_connect:875: sk 000000004dff667e<br /> iso_connect_cis:353: 70:1a:b8:98:ff:a2 -&gt; 28:3d:c2:4a:7e:da<br /> hci_get_route:1199: 70:1a:b8:98:ff:a2 -&gt; 28:3d:c2:4a:7e:da<br /> hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da<br /> iso_conn_add:140: hcon 000000007b65d182 conn 00000000daf8625e<br /> __iso_chan_add:214: conn 00000000daf8625e<br /> iso_connect_cfm:1700: hcon 000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12<br /> iso_conn_del:187: hcon 000000007b65d182 conn 00000000daf8625e, err 16<br /> iso_sock_clear_timer:117: sock 000000004dff667e state 3<br /> <br /> iso_chan_del:153: sk 000000004dff667e, conn 00000000daf8625e, err 16<br /> hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535<br /> hci_conn_unlink:1102: hci0: hcon 000000007b65d182<br /> hci_chan_list_flush:2780: hcon 000000007b65d182<br /> iso_sock_getsockopt:1376: sk 000000004dff667e<br /> iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e<br /> iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e<br /> iso_sock_getsockopt:1376: sk 000000004dff667e<br /> iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e<br /> iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e<br /> iso_sock_shutdown:1434: sock 00000000be9b69b7, sk 000000004dff667e, how 1<br /> __iso_sock_close:632: sk 000000004dff667e state 5 socket 00000000be9b69b7<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> PGD 8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0<br /> Oops: 0000 [#1] PREEMPT SMP PTI<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014<br /> RIP: 0010:__iso_sock_close (net/bluetooth/iso.c:664) bluetooth<br /> ===============================================================<br /> <br /> Trace with iso_conn_del before iso_chan_add in iso_connect_cis:<br /> ===============================================================<br /> iso_connect_cis:356: 70:1a:b8:98:ff:a2 -&gt; 28:3d:c2:4a:7e:da<br /> ...<br /> iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504<br /> hci_dev_put:1487: hci0 orig refcnt 21<br /> hci_event_packet:7607: hci0: e<br /> ---truncated---