In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 2.8
Impact Score: 5.9
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341be8f80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384e13d40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369405e40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36066a740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341be8980> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2d2496500> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c47eb80> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd36b436e00> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd36066ba80> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd341bea1c0> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd36a621080> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd385617800> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd369406e00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd386745ec0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd39c47d980> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd341bc2d00> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |