Linux Kernel Bluetooth BNEP Use-After-Free Vulnerability in Connection Management

A use-after-free vulnerability has been addressed in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. The issue arises in the 'bnep_add_connection()' function, which failed to properly synchronize access to the 'dev->name' property of a network device. This oversight allowed a concurrent thread, handling the removal of a BNEP connection, to free the network device while it was still being accessed, leading to a potential use-after-free scenario. Although this vulnerability is not considered highly security-sensitive—since adding a BNEP connection requires administrative privileges and involves dismantling a network device during a brief, vulnerable period— it could still be exploited under specific conditions.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, where a program continues to use a pointer after the memory it points to has been freed. This can potentially be exploited to execute arbitrary code or cause a crash.

Reproduction

To reproduce this vulnerability, initiate a BNEP connection by calling the 'bnep_add_connection()' function while simultaneously triggering a 'bnep_del_connection()' call on the same connection. This race condition can cause the 'bnep_add_connection()' function to access the 'dev->name' property of a network device that has already been freed, creating a use-after-free vulnerability.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.