Linux Kernel Bluetooth ISO Socket Timer Handling Vulnerability

A vulnerability in the Linux kernel's handling of Bluetooth ISO sockets can lead to a null pointer dereference or a use-after-free condition. This issue arises because the function 'iso_sock_close()' calls 'iso_sock_clear_timer()' before acquiring the necessary socket lock. 'iso_sock_clear_timer()' accesses the connection information twice without the socket lock, creating a race condition. Meanwhile, 'iso_conn_del()' operates under the socket lock and can nullify the connection reference, potentially dropping the last connection reference. The vulnerability has been addressed by synchronizing 'iso_sock_clear_timer()' with the socket lock, aligning it with the practices used in other related functions.

Impact

Exploitation of this vulnerability can cause a null pointer dereference or a use-after-free condition, both of which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

To reproduce this vulnerability, initiate a Bluetooth connection using the BTPROTO_ISO socket type. Then, close the socket without first acquiring the socket lock. This sequence will create a race condition where 'iso_sock_clear_timer()' can be called while 'iso_conn_del()' is simultaneously modifying the connection reference, leading to a null pointer dereference or use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux documentation.