Linux Kernel Bluetooth ISO Socket Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's Bluetooth ISO socket implementation. The issue arises in the 'iso_recv_frame' function, where the connection's socket is accessed under a lock, but the lock is released before the socket is used, leaving a window for it to be freed by a concurrent operation. This leads to a use-after-free condition on the socket's state and received data queue. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, allowing for potential memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by sending a Bluetooth ISO packet to a connection while simultaneously invoking 'iso_sock_kill' on the same connection. This will create a race condition where the socket is freed before it is safely used, causing a use-after-free error.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the updated kernel can be found on the official Linux kernel website.