CVE-2024-42141

Bluetooth: ISO: Check socket flag instead of hcon

published July 30, 2024

CVSS
—
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Check socket flag instead of hcon

This fixes the following Smatch static checker warning:

net/bluetooth/iso.c:1364 iso_sock_recvmsg()

error: we previously assumed 'pi->conn->hcon' could be null (line 1359)

net/bluetooth/iso.c

1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,

1348 size_t len, int flags)

1349 {

1350 struct sock *sk = sock->sk;

1351 struct iso_pinfo *pi = iso_pi(sk);

1352

1353 BT_DBG("sk %p", sk);

1354

1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,

&bt_sk(sk)->flags)) {

1356 lock_sock(sk);

1357 switch (sk->sk_state) {

1358 case BT_CONNECT2:

1359 if (pi->conn->hcon &&

^^^^^^^^^^^^^^ If ->hcon is NULL

1360 test_bit(HCI_CONN_PA_SYNC,

&pi->conn->hcon->flags)) {

1361 iso_conn_big_sync(sk);

1362 sk->sk_state = BT_LISTEN;

1363 } else {

--> 1364 iso_conn_defer_accept(pi->conn->hcon);

^^^^^^^^^^^^^^

then we're toast

1365 sk->sk_state = BT_CONFIG;

1366 }

1367 release_sock(sk);

1368 return 0;

1369 case BT_CONNECTED:

1370 if (test_bit(BT_SK_PA_SYNC,

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2024-07-30T07:46Z
EPSS history
Timeline
  • 30 JUL 07:46Z
    Bluetooth: ISO: Check socket flag instead of hcon
    cvelistv5