CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's Bluetooth subsystem, specifically in the handling of connection hash lookups, which can lead to a use-after-free (UAF) condition due to improper management of RCU-protected pointers. This flaw may allow an attacker to exploit concurrent deletion of connection objects, potentially leading to system instability or unauthorized access. Organizations using Linux systems with Bluetooth capabilities should prioritize this issue to mitigate risks associated with potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hci_conn_hash lookup and use of the returned conn. Add surrounding rcu_read_lock() also when return value is not used, in preparation for RCU lockdep requirement to hci_lookup_le_connect(). This avoids concurrent deletion of the conn before we are done dereferencing it. Also, make sure to hold hdev->lock when accessing hdev->accept_list.