blob: bb9547e25cf35262509337cbd96e2f3f67733de1 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
Description: UAF in sco_send_frame function
References:
https://www.openwall.com/lists/oss-security/2021/07/22/1
https://bugzilla.suse.com/show_bug.cgi?id=1188172
https://x-lore.kernel.org/all/883dc4b7-d1a1-3d31-a5a8-8fa1791084b6@i-love.sakura.ne.jp/
Notes:
carnil> Prerequisites before the "last piece for fixing CVE-2021-3640"
carnil> are e04480920d1e ("Bluetooth: defer cleanup of resources in
carnil> hci_unregister_dev()") and 734bc5ff7831 ("Bluetooth: avoid
carnil> circular locks in sco_sock_connect"), ba316be1b6a0 ("Bluetooth:
carnil> schedule SCO timeouts with delayed_work"), 27c24fda62b6
carnil> ("Bluetooth: switch to lock_sock in SCO")
Bugs:
upstream: needed
5.10-upstream-stable: needed
4.19-upstream-stable: needed
4.9-upstream-stable: needed
sid: needed
5.10-bullseye-security: needed
4.19-buster-security: needed
4.9-stretch-security: needed
|
