Linux Kernel Bluetooth Data-Race Vulnerability in ISO Connection Handling

A data-race vulnerability has been identified in the Linux kernel's Bluetooth ISO connection management. The issue arises in several functions, including iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync(). These functions call hci_get_route() using certain socket fields without holding the necessary lock, allowing concurrent modifications by other operations. This oversight leads to data-races, as reported by the Kernel Concurrency Sanitizer (KCSAN). The vulnerability has been addressed by modifying the functions to snapshot the required fields under lock before calling hci_get_route(), thereby preventing concurrent access issues.

Impact

The vulnerability could lead to unpredictable behavior in Bluetooth ISO connections, potentially causing synchronization issues or connection management errors.

Reproduction

The vulnerability can be reproduced by initiating Bluetooth ISO connections or listening operations without the proper socket locks, allowing concurrent modifications to the connection parameters. This can be done by manipulating the ISO socket fields through connect() or setsockopt() calls on the same socket, creating a data-race condition.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the official Linux kernel Git repository.