From bippy-c9c4e1df01b2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman To: Reply-to: , Subject: CVE-2022-48971: Bluetooth: Fix not cleanup led when bt_init fails Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 The Linux kernel CVE team has assigned CVE-2022-48971 to this issue. Affected and fixed versions =========================== Issue introduced in 4.9 with commit e64c97b53bc6 and fixed in 4.19.269 with commit 8a66c3a94285 Issue introduced in 4.9 with commit e64c97b53bc6 and fixed in 5.4.227 with commit 2c6cf0afc385 Issue introduced in 4.9 with commit e64c97b53bc6 and fixed in 5.10.159 with commit e7b950458156 Issue introduced in 4.9 with commit e64c97b53bc6 and fixed in 5.15.83 with commit edf7284a9829 Issue introduced in 4.9 with commit e64c97b53bc6 and fixed in 6.0.13 with commit 5ecf7cd6fde5 Issue introduced in 4.9 with commit e64c97b53bc6 and fixed in 6.1 with commit 2f3957c7eb4e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48971 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bluetooth/af_bluetooth.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8a66c3a94285552f6a8e45d73b34ebbad11d388b https://git.kernel.org/stable/c/2c6cf0afc3856359e620e96edd952457d258e16c https://git.kernel.org/stable/c/e7b950458156d410509a08c41930b75e72985938 https://git.kernel.org/stable/c/edf7284a98296369dd0891a0457eec37df244873 https://git.kernel.org/stable/c/5ecf7cd6fde5e72c87122084cf00d63e35d8dd9f https://git.kernel.org/stable/c/2f3957c7eb4e07df944169a3e50a4d6790e1c744