In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: pin L2CAP connection during netdev registration
bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee
416baaa9-dc9f-4396-8d5f-8c081fb06d67