CVE-2022-50833
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works syzbot is reporting attempt to schedule hdev->cmd_work work from system_wq WQ into hdev->workqueue WQ which is under draining operation [1], for commit c8efcc2589464ac7 ("workqueue: allow chained queueing during destruction") does not allow such operation. The check introduced by commit 877afadad2dce8aa ("Bluetooth: When HCI work queue is drained, only queue chained work") was incomplete. Use hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because hci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect the queuing operation with RCU read lock in order to avoid calling queue_delayed_work() after cancel_delayed_work() completed.
How to fix
- Linux Linuxc4635cf3d845a7324c25c52d549b70c8bd7ad4c7, 3c6b036fe5c8ed8b6c4cbdc03605929882907ef0, deee93d13d385103205879a8a0915036ecd83261, 5.19.15, 5.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3b382555706558f5c0587862b6dc03e96a252bba ≤ v < c4635cf3d845a7324c25c52d549b70c8bd7ad4c7, 877afadad2dce8aae1f2aad8ce47e072d4f6165e ≤ v < 3c6b036fe5c8ed8b6c4cbdc03605929882907ef0, 877afadad2dce8aae1f2aad8ce47e072d4f6165e ≤ v < deee93d13d385103205879a8a0915036ecd83261, 4bf367fa1fefabdf14938d0ac9ed60020389112e, 5.19.2 ≤ v < 5.19.15, 5.18.18 ≤ v < 5.19, 6.0 | c4635cf3d845a7324c25c52d549b70c8bd7ad4c7, 3c6b036fe5c8ed8b6c4cbdc03605929882907ef0, deee93d13d385103205879a8a0915036ecd83261, 5.19.15, 5.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.