CyberRota Analysis
AI-GeneratedA use-after-free vulnerability exists in the Bluetooth BNEP implementation of the Linux kernel, specifically in the bnep_add_connection() function, which can lead to reading freed memory if not properly synchronized. While the exploit requires elevated privileges (CAP_NET_ADMIN) and involves a specific race condition, it poses a significant risk to systems utilizing Bluetooth functionality. Organizations using affected Linux distributions should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)
Related CVEs
Other vulnerabilities affecting the same vendor(s)