Linux Kernel Bluetooth l2cap_core.c's l2cap_le_connect_req use after free

Summaryinfo

A vulnerability was found in Linux Kernel. It has been classified as critical. This vulnerability affects the function l2cap_le_connect_req of the file net/bluetooth/l2cap_core.c's of the component Bluetooth Handler. This manipulation causes use after free. This vulnerability is handled as CVE-2022-42896. The attack can only be done within the local network. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Linux Kernel (Operating System) (unknown version). It has been declared as critical. Affected by this vulnerability is the function l2cap_le_connect_req of the file net/bluetooth/l2cap_core.c's of the component Bluetooth Handler. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url

The weakness was released 11/23/2022 as 711f8c3fb3db61897080468586b970c87c61d9e4. The advisory is shared at github.com. This vulnerability is known as CVE-2022-42896 since 10/12/2022. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/18/2025).

The vulnerability scanner Nessus provides a plugin with the ID 236648 (Alibaba Cloud Linux 3 : 0002: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0002)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 711f8c3fb3db61897080468586b970c87c61d9e4 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (236648). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion