In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: L2CAP: gestionar puntero sock NULL en l2cap_sock_alloc Se pasa un puntero sock NULL a l2cap_sock_alloc() cuando se llama desde l2cap_sock_new_connection_cb() y las rutas de gestión de errores también deberían tenerlo en cuenta. Aparentemente, una solución más elegante sería intercambiar las llamadas bt_sock_alloc() y l2cap_chan_create() ya que no son interdependientes en ese momento, pero luego l2cap_chan_create() agrega el canal que pronto se desasignará y aún tiene inicialización ficticia a la lista global accesible por muchas rutas L2CAP. El canal se eliminaría de la lista en un corto período de tiempo, pero aquí sería un poco más directo y solo verificaría si es NULL en lugar de cambiar el orden de las llamadas de función. Encontrado por Linux Verification Center (linuxtesting.org) con la herramienta de análisis estático SVACE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b8ceac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c3fd1c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd34b77f440> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a7caf80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b8cd3c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbcce4c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3703ff500> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |