Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.
Product status
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before d57384e27d1ebf0047e3f00a6e1181b8be9857a2
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before b0a7da0e3f7442545f071499beb36374714bb9de
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 108b81514d8f2535eb16651495cefb2250528db3
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before e76e8f0581ef555eacc11dbb095e602fb30a5361
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (git) before 598dbba9919c5e36c54fe1709b557d64120cb94b
2.6.12
Any version before 2.6.12
5.15.203 (semver)
6.1.168 (semver)
6.6.131 (semver)
6.12.80 (semver)
6.18.21 (semver)
6.19.11 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2
git.kernel.org/...c/b0a7da0e3f7442545f071499beb36374714bb9de
git.kernel.org/...c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1
git.kernel.org/...c/108b81514d8f2535eb16651495cefb2250528db3
git.kernel.org/...c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e
git.kernel.org/...c/e76e8f0581ef555eacc11dbb095e602fb30a5361
git.kernel.org/...c/598dbba9919c5e36c54fe1709b557d64120cb94b