From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6FFE1F4283 for ; Fri, 27 Dec 2024 13:56:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735307795; cv=none; b=aOFy7jYXudrjHsFwl+qVgQyuQ86JWapkGMywIxq34w6y+RBsr7wS2FB+ruqUDYlJe5Aihr7WFcYkQHxm/TH4Ic0eU5V9ksWKOUqfq+OmAOzbPBadfUOfZy5FnjqwotCXAbUXjLMHooLkG3kQNWThSd+kt5AxB9A2BQWbDIEGvXw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735307795; c=relaxed/simple; bh=28ypWbPu0K/bGILDTPeabL1aTh/2Vtp6YTNuP33Itwk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NbysMG2TWNtIobheGFLQkWOu6Z+utyhcU1OapaUoRM37ff9d1XHilZzJ468bSS5NgeCYDlMnRQmqOwdY/wvHRjqshRZD7xxM/sHjVO+Uxu2iQefnFrW72hWyQroyTlNwsstVmCgZcRzHRxe6AcCujxGKzxlug0ZjDbZVQf7MOII= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OsJ2VBhT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="OsJ2VBhT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 135B9C4CED0; Fri, 27 Dec 2024 13:56:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1735307794; bh=28ypWbPu0K/bGILDTPeabL1aTh/2Vtp6YTNuP33Itwk=; h=From:To:Cc:Subject:Date:Reply-to:From; b=OsJ2VBhT8rT1oyjRUH/a6zNXfYv5xLwn+fzMx9cftd7abj9AxrRmPfvDuMRqbe8hL c2LCP/0GcRMCAMYQPnbTUDjZZAwzRJzjHi88XnYB5IgNWWtJ0YXhx25oyvr17ZnAl0 RO3X0ciHknsnQEE/QXyt4RcU/jmMDjyUrI9+RMP8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-53238: Bluetooth: btmtk: adjust the position to init iso data anchor Date: Fri, 27 Dec 2024 14:53:24 +0100 Message-ID: <2024122739-CVE-2024-53238-ea1c@gregkh> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4865; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=28ypWbPu0K/bGILDTPeabL1aTh/2Vtp6YTNuP33Itwk=; b=owGbwMvMwCRo6H6F97bub03G02pJDOl5G9X/vmq6uE/NjtddS/DL59WLZm0K1Td/d7vc0yvyR ppJ8rbujlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhImCzD/KK9S7laYieL1/9h Fq9R01BkO8TcyTDPaKe/1IGlCzq35zf3LzjFtKWhVl0FAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: adjust the position to init iso data anchor MediaTek iso data anchor init should be moved to where MediaTek claims iso data interface. If there is an unexpected BT usb disconnect during setup flow, it will cause a NULL pointer crash issue when releasing iso anchor since the anchor wasn't been init yet. Adjust the position to do iso data anchor init. [ 17.137991] pc : usb_kill_anchored_urbs+0x60/0x168 [ 17.137998] lr : usb_kill_anchored_urbs+0x44/0x168 [ 17.137999] sp : ffffffc0890cb5f0 [ 17.138000] x29: ffffffc0890cb5f0 x28: ffffff80bb6c2e80 [ 17.144081] gpio gpiochip0: registered chardev handle for 1 lines [ 17.148421] x27: 0000000000000000 [ 17.148422] x26: ffffffd301ff4298 x25: 0000000000000003 x24: 00000000000000f0 [ 17.148424] x23: 0000000000000000 x22: 00000000ffffffff x21: 0000000000000001 [ 17.148425] x20: ffffffffffffffd8 x19: ffffff80c0f25560 x18: 0000000000000000 [ 17.148427] x17: ffffffd33864e408 x16: ffffffd33808f7c8 x15: 0000000000200000 [ 17.232789] x14: e0cd73cf80ffffff x13: 50f2137c0a0338c9 x12: 0000000000000001 [ 17.239912] x11: 0000000080150011 x10: 0000000000000002 x9 : 0000000000000001 [ 17.247035] x8 : 0000000000000000 x7 : 0000000000008080 x6 : 8080000000000000 [ 17.254158] x5 : ffffffd33808ebc0 x4 : fffffffe033dcf20 x3 : 0000000080150011 [ 17.261281] x2 : ffffff8087a91400 x1 : 0000000000000000 x0 : ffffff80c0f25588 [ 17.268404] Call trace: [ 17.270841] usb_kill_anchored_urbs+0x60/0x168 [ 17.275274] btusb_mtk_release_iso_intf+0x2c/0xd8 [btusb (HASH:5afe 6)] [ 17.284226] btusb_mtk_disconnect+0x14/0x28 [btusb (HASH:5afe 6)] [ 17.292652] btusb_disconnect+0x70/0x140 [btusb (HASH:5afe 6)] [ 17.300818] usb_unbind_interface+0xc4/0x240 [ 17.305079] device_release_driver_internal+0x18c/0x258 [ 17.310296] device_release_driver+0x1c/0x30 [ 17.314557] bus_remove_device+0x140/0x160 [ 17.318643] device_del+0x1c0/0x330 [ 17.322121] usb_disable_device+0x80/0x180 [ 17.326207] usb_disconnect+0xec/0x300 [ 17.329948] hub_quiesce+0x80/0xd0 [ 17.333339] hub_disconnect+0x44/0x190 [ 17.337078] usb_unbind_interface+0xc4/0x240 [ 17.341337] device_release_driver_internal+0x18c/0x258 [ 17.346551] device_release_driver+0x1c/0x30 [ 17.350810] usb_driver_release_interface+0x70/0x88 [ 17.355677] proc_ioctl+0x13c/0x228 [ 17.359157] proc_ioctl_default+0x50/0x80 [ 17.363155] usbdev_ioctl+0x830/0xd08 [ 17.366808] __arm64_sys_ioctl+0x94/0xd0 [ 17.370723] invoke_syscall+0x6c/0xf8 [ 17.374377] el0_svc_common+0x84/0xe0 [ 17.378030] do_el0_svc+0x20/0x30 [ 17.381334] el0_svc+0x34/0x60 [ 17.384382] el0t_64_sync_handler+0x88/0xf0 [ 17.388554] el0t_64_sync+0x180/0x188 [ 17.392208] Code: f9400677 f100a2f4 54fffea0 d503201f (b8350288) [ 17.398289] ---[ end trace 0000000000000000 ]--- The Linux kernel CVE team has assigned CVE-2024-53238 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit ceac1cb0259de682d78f5c784ef8e0b13022e9d9 and fixed in 6.11.11 with commit d8bd79f0eea9c07d90ce870a714ab5c10afaa4b3 Issue introduced in 6.11 with commit ceac1cb0259de682d78f5c784ef8e0b13022e9d9 and fixed in 6.12.2 with commit 1219c211ccd061cde002cc5708692efca515a7a0 Issue introduced in 6.11 with commit ceac1cb0259de682d78f5c784ef8e0b13022e9d9 and fixed in 6.13-rc1 with commit 61c5a3def90ac729a538e5ca5ff7f461cff72776 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-53238 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/bluetooth/btmtk.c drivers/bluetooth/btusb.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d8bd79f0eea9c07d90ce870a714ab5c10afaa4b3 https://git.kernel.org/stable/c/1219c211ccd061cde002cc5708692efca515a7a0 https://git.kernel.org/stable/c/61c5a3def90ac729a538e5ca5ff7f461cff72776