Linux Kernel Bluetooth Subsystem Use-After-Free Vulnerability in Connection Synchronization

A use-after-free vulnerability has been identified in the Bluetooth subsystem of the Linux kernel, specifically within the connection synchronization process. The issue arises in the 'hci_le_create_cis_sync' function, where the 'conn->conn_timeout' is accessed after releasing both the 'rcu_read_lock' and 'hci_dev_lock'. This creates a window where a concurrent disconnect can free the 'hci_conn' structure, leading to a use-after-free read. The problem is exacerbated by the way pending commands are managed, as the cancellation mechanism cannot effectively prevent the issue. This vulnerability was discovered using an automated security auditing tool.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, allowing for potentially arbitrary memory access and manipulation, which could be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by initiating a Bluetooth connection and then concurrently disconnecting it while a 'LE Create CIS' command is being processed. This can be done by manually disconnecting the device or by using a script that automates the process. The key is to time the disconnection so that it occurs after the locks are released but before the command processing is complete, causing the 'hci_conn' structure to be freed while it is still being accessed.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the official Linux documentation.