Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation. Specifically, the function rfcomm_get_sock_by_channel() scans a list of sockets under a lock but returns a listener socket after releasing that lock without taking a reference to it. Subsequently, rfcomm_connect_ind() locks the listener, queues a child socket, and may notify it after unlocking. However, a race condition can occur if the listener socket is closed and freed by another process before rfcomm_connect_ind() finishes its operations, leading to a use-after-free scenario.

The problem arises because rfcomm_connect_ind() does not hold a reference to the listener socket after dropping the list lock, allowing the listener to be freed concurrently. This can cause memory corruption or crashes when the freed listener is accessed. The fix involves taking a reference on the listener before releasing the list lock and rechecking its state after locking it to ensure it is still valid before proceeding.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Bluetooth RFCOMM code of the Linux kernel. Exploiting this could cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by triggering the race condition that frees and then accesses the listener socket.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by taking a reference on the listener before leaving rfcomm_sk_list.lock, rechecking that it is still in BT_LISTEN after lock_sock() succeeds, caching the deferred-setup bit while the parent is locked, and dropping the reference after the last parent use.

Therefore, immediate mitigation involves updating the Linux kernel to a version that includes this fix to prevent use-after-free conditions in the Bluetooth RFCOMM code.

Useful 0 Not Useful 0