{
  "threat_severity" : "Important",
  "public_date" : "2025-05-01T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu",
    "id" : "2363393",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2363393"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu\nFix the race condition between the following two flows that run in\nparallel:\n1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) ->\n__sock_queue_rcv_skb.\n2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram.\nAn SKB can be queued by the first flow and immediately dequeued and\nfreed by the second flow, therefore the callers of l2cap_reassemble_sdu\ncan't use the SKB after that function returns. However, some places\ncontinue accessing struct l2cap_ctrl that resides in the SKB's CB for a\nshort time after l2cap_reassemble_sdu returns, leading to a\nuse-after-free condition (the stack trace is below, line numbers for\nkernel 5.19.8).\nFix it by keeping a local copy of struct l2cap_ctrl.\nBUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\nRead of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169\nWorkqueue: hci0 hci_rx_work [bluetooth]\nCall Trace:\n<TASK>\ndump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))\nprint_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429)\n? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\nkasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493)\n? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\nl2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\nl2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth\nret_from_fork (arch/x86/entry/entry_64.S:306)\n</TASK>\nAllocated by task 43169:\nkasan_save_stack (mm/kasan/common.c:39)\n__kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)\nkmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293)\n__alloc_skb (net/core/skbuff.c:414)\nl2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth\nl2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth\nhci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth\nprocess_one_work (kernel/workqueue.c:2289)\nworker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437)\nkthread (kernel/kthread.c:376)\nret_from_fork (arch/x86/entry/entry_64.S:306)\nFreed by task 27920:\nkasan_save_stack (mm/kasan/common.c:39)\nkasan_set_track (mm/kasan/common.c:45)\nkasan_set_free_info (mm/kasan/generic.c:372)\n____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328)\nslab_free_freelist_hook (mm/slub.c:1780)\nkmem_cache_free (mm/slub.c:3536 mm/slub.c:3553)\nskb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323)\nbt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth\nl2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth\nsock_read_iter (net/socket.c:1087)\nnew_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401)\nvfs_read (fs/read_write.c:482)\nksys_read (fs/read_write.c:620)\ndo_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)" ],
  "statement" : "The bug could happen if Bluetooth being used. Due to the complexity to reproduce it where kind of race condition should happen between bt_sock_recvmsg and l2cap_reassemble_sdu functions. The bug already fixed for the Red Hat Enterprise Linux 9 (all versions) and later, and actual only for Red Hat Enterprise Linux 8.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2023-07-18T00:00:00Z",
    "advisory" : "RHSA-2023:4151",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kernel-0:3.10.0-1160.95.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-05-16T00:00:00Z",
    "advisory" : "RHSA-2023:2951",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-477.10.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support",
    "release_date" : "2023-05-31T00:00:00Z",
    "advisory" : "RHSA-2023:3388",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.6",
    "package" : "kernel-0:4.18.0-372.57.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-02-28T00:00:00Z",
    "advisory" : "RHSA-2023:0951",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-162.18.1.el9_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-02-28T00:00:00Z",
    "advisory" : "RHSA-2023:0951",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-162.18.1.el9_1"
  }, {
    "product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8",
    "release_date" : "2023-05-31T00:00:00Z",
    "advisory" : "RHSA-2023:3388",
    "cpe" : "cpe:/o:redhat:rhev_hypervisor:4.4::el8",
    "package" : "kernel-0:4.18.0-372.57.1.el8_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-49910\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49910\nhttps://lore.kernel.org/linux-cve-announce/2025050104-CVE-2022-49910-96ae@gregkh/T" ],
  "name" : "CVE-2022-49910",
  "mitigation" : {
    "value" : "The only way to mitigate these vulnerabilities on the operating system level is to disable the Bluetooth functionality via blacklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. How to disable Bluetooth modules instructions are available on the Customer Portal at https://access.redhat.com/solutions/2682931.\nAlternatively, Bluetooth can be disabled within the hardware or at BIOS level, which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.",
    "lang" : "en:us"
  },
  "csaw" : false
}