CVE-2022-49909

一、漏洞信息
 漏洞编号：[CVE-2022-49909](https://nvd.nist.gov/vuln/detail/CVE-2022-49909)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：7.8 High
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()When l2cap_recv_frame() is invoked to receive data, and the cid isL2CAP_CID_A2MP, if the channel does not exist, it will create a channel.However, after a channel is created, the hold operation of the channelis not performed. In this case, the value of channel reference countingis 1. As a result, after hci_error_reset() is triggered, l2cap_conn_del()invokes the close hook function of A2MP to release the channel. Then l2cap_chan_unlock(chan) will trigger UAF issue.The process is as follows:Receive data:l2cap_data_channel()    a2mp_channel_create()  --->channel ref is 2    l2cap_chan_put()       --->channel ref is 1Triger event:    hci_error_reset()        hci_dev_do_close()        ...        l2cap_disconn_cfm()            l2cap_conn_del()                l2cap_chan_hold()    --->channel ref is 2                l2cap_chan_del()     --->channel ref is 1                a2mp_chan_close_cb() --->channel ref is 0, release channel                l2cap_chan_unlock()  --->UAF of channelThe detailed Call Trace is as follows:BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0xa6/0x5e0Read of size 8 at addr ffff8880160664b8 by task kworker/u11:1/7593Workqueue: hci0 hci_error_resetCall Trace: <TASK> dump_stack_lvl+0xcd/0x134 print_report.cold+0x2ba/0x719 kasan_report+0xb1/0x1e0 kasan_check_range+0x140/0x190 __mutex_unlock_slowpath+0xa6/0x5e0 l2cap_conn_del+0x404/0x7b0 l2cap_disconn_cfm+0x8c/0xc0 hci_conn_hash_flush+0x11f/0x260 hci_dev_close_sync+0x5f5/0x11f0 hci_dev_do_close+0x2d/0x70 hci_error_reset+0x9e/0x140 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK>Allocated by task 7593: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0xa9/0xd0 l2cap_chan_create+0x40/0x930 amp_mgr_create+0x96/0x990 a2mp_channel_create+0x7d/0x150 l2cap_recv_frame+0x51b8/0x9a70 l2cap_recv_acldata+0xaa3/0xc00 hci_rx_work+0x702/0x1220 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30Freed by task 7593: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 ____kasan_slab_free+0x167/0x1c0 slab_free_freelist_hook+0x89/0x1c0 kfree+0xe2/0x580 l2cap_chan_put+0x22a/0x2d0 l2cap_conn_del+0x3fc/0x7b0 l2cap_disconn_cfm+0x8c/0xc0 hci_conn_hash_flush+0x11f/0x260 hci_dev_close_sync+0x5f5/0x11f0 hci_dev_do_close+0x2d/0x70 hci_error_reset+0x9e/0x140 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0xbe/0xd0 call_rcu+0x99/0x740 netlink_release+0xe6a/0x1cf0 __sock_release+0xcd/0x280 sock_close+0x18/0x20 __fput+0x27c/0xa90 task_work_run+0xdd/0x1a0 exit_to_user_mode_prepare+0x23c/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcdSecond to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0xbe/0xd0 call_rcu+0x99/0x740 netlink_release+0xe6a/0x1cf0 __sock_release+0xcd/0x280 sock_close+0x18/0x20 __fput+0x27c/0xa90 task_work_run+0xdd/0x1a0 exit_to_user_mode_prepare+0x23c/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 漏洞公开时间：2025-05-01 23:16:16
 漏洞创建时间：2025-05-02 01:27:53
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-49909
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0d0e2d032811280b927650ff3c15fe5020e82533 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/17c6164854f8bb80bf76f32b2c2f199c16b53703 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7f7bfdd9a9af3b12c33d9da9a012e7f4d5c91f4b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8f7e4cf0694149a5d999d676ebd9ecf1b4cb2cc9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a3a7b2ac64de232edb67279e804932cb42f0b52a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c1f594dddd9ffd747c39f49cc5b67a9b7677d2ab |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d9ec6e2fbd4a565b2345d4852f586b7ae3ab41fd |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/db4a0783ed78beb2ebaa32f5f785bfd79c580689 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-49909 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-49909 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/0d0e2d032811280b927650ff3c15fe5020e82533 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/17c6164854f8bb80bf76f32b2c2f199c16b53703 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/7f7bfdd9a9af3b12c33d9da9a012e7f4d5c91f4b | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/8f7e4cf0694149a5d999d676ebd9ecf1b4cb2cc9 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/a3a7b2ac64de232edb67279e804932cb42f0b52a | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/c1f594dddd9ffd747c39f49cc5b67a9b7677d2ab | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/d9ec6e2fbd4a565b2345d4852f586b7ae3ab41fd | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/stable/c/db4a0783ed78beb2ebaa32f5f785bfd79c580689 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-49909.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363428 | https://bugzilla.suse.com/show_bug.cgi?id=1242453 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025050104-CVE-2022-49909-60e6@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2363428 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-49909 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/0d0e2d032811280b927650ff3c15fe5020e82533 |  | nvd |
|  |  | https://git.kernel.org/stable/c/17c6164854f8bb80bf76f32b2c2f199c16b53703 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7f7bfdd9a9af3b12c33d9da9a012e7f4d5c91f4b |  | nvd |
|  |  | https://git.kernel.org/stable/c/8f7e4cf0694149a5d999d676ebd9ecf1b4cb2cc9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/a3a7b2ac64de232edb67279e804932cb42f0b52a |  | nvd |
|  |  | https://git.kernel.org/stable/c/c1f594dddd9ffd747c39f49cc5b67a9b7677d2ab |  | nvd |
|  |  | https://git.kernel.org/stable/c/d9ec6e2fbd4a565b2345d4852f586b7ae3ab41fd |  | nvd |
|  |  | https://git.kernel.org/stable/c/db4a0783ed78beb2ebaa32f5f785bfd79c580689 |  | nvd |
| linux_kernel | 4.9.333 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=db4a0783ed78beb2ebaa32f5f785bfd79c580689 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 4.14.299 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=17c6164854f8bb80bf76f32b2c2f199c16b53703 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 4.19.265 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7f7bfdd9a9af3b12c33d9da9a012e7f4d5c91f4b | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 5.4.224 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c1f594dddd9ffd747c39f49cc5b67a9b7677d2ab | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 5.10.154 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d9ec6e2fbd4a565b2345d4852f586b7ae3ab41fd | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 5.15.78 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a3a7b2ac64de232edb67279e804932cb42f0b52a | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 6.0.8 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8f7e4cf0694149a5d999d676ebd9ecf1b4cb2cc9 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |
| linux_kernel | 6.1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0d0e2d032811280b927650ff3c15fe5020e82533 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d255c861e268ba342e855244639a15f12d7a0bf2 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()When l2cap_recv_frame() is invoked to receive data, and the cid isL2CAP_CID_A2MP, if the channel does not exist, it will create a channel.However, after a channel is created, the hold operation of the channelis not performed. In this case, the value of channel reference countingis 1. As a result, after hci_error_reset() is triggered, l2cap_conn_del()invokes the close hook function of A2MP to release the channel. Then l2cap_chan_unlock(chan) will trigger UAF issue.The process is as follows:Receive data:l2cap_data_channel()    a2mp_channel_create()  ---&gt;channel ref is 2    l2cap_chan_put()       ---&gt;channel ref is 1Triger event:    hci_error_reset()        hci_dev_do_close()        ...        l2cap_disconn_cfm()            l2cap_conn_del()                l2cap_chan_hold()    ---&gt;channel ref is 2                l2cap_chan_del()     ---&gt;channel ref is 1                a2mp_chan_close_cb() ---&gt;channel ref is 0, release channel                l2cap_chan_unlock()  ---&gt;UAF of channelThe detailed Call Trace is as follows:BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0xa6/0x5e0Read of size 8 at addr ffff8880160664b8 by task kworker/u11:1/7593Workqueue: hci0 hci_error_resetCall Trace: &lt;TASK&gt; dump_stack_lvl+0xcd/0x134 print_report.cold+0x2ba/0x719 kasan_report+0xb1/0x1e0 kasan_check_range+0x140/0x190 __mutex_unlock_slowpath+0xa6/0x5e0 l2cap_conn_del+0x404/0x7b0 l2cap_disconn_cfm+0x8c/0xc0 hci_conn_hash_flush+0x11f/0x260 hci_dev_close_sync+0x5f5/0x11f0 hci_dev_do_close+0x2d/0x70 hci_error_reset+0x9e/0x140 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 &lt;/TASK&gt;Allocated by task 7593: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0xa9/0xd0 l2cap_chan_create+0x40/0x930 amp_mgr_create+0x96/0x990 a2mp_channel_create+0x7d/0x150 l2cap_recv_frame+0x51b8/0x9a70 l2cap_recv_acldata+0xaa3/0xc00 hci_rx_work+0x702/0x1220 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30Freed by task 7593: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 ____kasan_slab_free+0x167/0x1c0 slab_free_freelist_hook+0x89/0x1c0 kfree+0xe2/0x580 l2cap_chan_put+0x22a/0x2d0 l2cap_conn_del+0x3fc/0x7b0 l2cap_disconn_cfm+0x8c/0xc0 hci_conn_hash_flush+0x11f/0x260 hci_dev_close_sync+0x5f5/0x11f0 hci_dev_do_close+0x2d/0x70 hci_error_reset+0x9e/0x140 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0xbe/0xd0 call_rcu+0x99/0x740 netlink_release+0xe6a/0x1cf0 __sock_release+0xcd/0x280 sock_close+0x18/0x20 __fput+0x27c/0xa90 task_work_run+0xdd/0x1a0 exit_to_user_mode_prepare+0x23c/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcdSecond to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0xbe/0xd0 call_rcu+0x99/0x740 netlink_release+0xe6a/0x1cf0 __sock_release+0xcd/0x280 sock_close+0x18/0x20 __fput+0x27c/0xa90 task_work_run+0xdd/0x1a0 exit_to_user_mode_prepare+0x23c/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcdThe Linux kernel CVE team has assigned CVE-2022-49909 to this issue.
 openEuler评分：
  7.8
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响
9.openEuler-24.03-LTS-SP3(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-SP3(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-49909

Comments (7)

Search

src-openEuler/kernel
Closed