Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling “usb_driver_release_interface(&btusb_driver, data->intf)” will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free’d.
Details
- Affected product:
- Oracle Linux 7 ELS , Ubuntu 20.04 ELS
- Affected packages:
- kernel @ 3.10.0 (+2 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Debian 11 | Released |
36 kernels
|
| Debian 11 cloud | Released |
16 kernels
|
| Debian 12 | Released |
32 kernels
|
| Debian 13 | Will Not Fix | — |
| Oracle Linux 7 UEK 6 | Released |
112 kernels
|
| Oracle Linux 8 UEK 6 | Released |
143 kernels
|
| Oracle Linux 8 UEK 7 | Released |
83 kernels
|
| Oracle Linux 9 UEK 7 | Released |
83 kernels
|
| Proxmox VE 7 5.15 | Released |
47 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
57 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
40 kernels
|
| Ubuntu 22.04 | Released |
90 kernels
|
| Ubuntu 22.04 AWS | Released |
81 kernels
|
| Ubuntu 22.04 Azure | Released |
73 kernels
|
| Ubuntu 24.04 | Released |
39 kernels
|
| Ubuntu 24.04 AWS | Planned | — |