Executive brief
A vulnerability in the Linux kernel's Bluetooth component could allow a local user to cause a system deadlock. This occurs during specific Bluetooth RFCOMM operations, potentially leading to a partial or full system hang. While it does not allow for data theft, it can impact the availability and stability of affected devices.
Technical details
A deadlock vulnerability exists in the Linux kernel Bluetooth RFCOMM implementation due to a circular locking dependency. The function 'rfcomm_sk_state_change' attempts to acquire 'sock_lock', but it can be called while that lock is already held by 'rfcomm_sock_ioctl'. An attacker with local access could trigger this condition to cause a denial-of-service (system hang). The issue was identified using syzbot and has been resolved by removing the redundant 'lock_sock' call in 'rfcomm_sock_ioctl' within 'net/bluetooth/rfcomm/sock.c'.
Affected products
- Linux Linux Kernel 2.6.27 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.57, 6.7 to 6.11.4
Timeline
- 2024-10-21: disclosed
- 2024-10-21: advisory
- 2024-10-17: patched
References
- https://git.kernel.org/stable/c/08d1914293dae38350b8088980e59fbc699a72fe
- https://git.kernel.org/stable/c/38b2d5a57d125e1c17661b8308c0240c4a43b534
- https://git.kernel.org/stable/c/496b2ab0fd10f205e08909a125485fdc98843dbe
- https://git.kernel.org/stable/c/4cb9807c9b53bf1e5560420d26f319f528b50268
- https://git.kernel.org/stable/c/869c6ee62ab8f01bf2419e45326642be5c9b670a
- https://git.kernel.org/stable/c/b77b3fb12fd483cae7c28648903b1d8a6b275f01
- https://git.kernel.org/stable/c/ced98072d3511b232ae1d3347945f35f30c0e303