A vulnerability has been identified in the Linux kernel (CVE-2022-42896) that could potentially be exploited for remote code execution at the kernel level by sending a specially crafted L2CAP packet over Bluetooth. Additionally, another similar issue has been found (CVE-2022-42895) in the L2CAP handler, which can lead to a leak of kernel memory contents in configuration information packets. The first vulnerability has been present since August 2014 (kernel 3.16), while the second has been present since October 2011 (kernel 3.0). These vulnerabilities have been fixed in Linux kernel releases 6.1.0, 6.0.8, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154, and 5.15.78. Tracking the patch in distributions can be done on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.
To demonstrate the possibility of conducting a remote attack, exploit prototypes have been published that work on Ubuntu 22.04. To carry out the attack, the attacker must be within Bluetooth range — no prior pairing is required, but Bluetooth must be enabled on the target computer. To attack, it is sufficient to know the MAC address of the victim's device, which can be determined through sniffing or, in some devices, calculated based on the Wi-Fi MAC address.
The first vulnerability (CVE-2022-42896) is caused by accessing a memory area that has already been freed (use-after-free) in the implementation of the l2cap_connect and l2cap_le_connect_req functions — after establishing a channel via the callback call new_connection, no lock was applied to it, but a timer (__set_chan_timer) was set, which upon timeout calls the l2cap_chan_timeout function and cleans up the channel without checking for the completion of work with the channel in the l2cap_le_connect* functions.
By default, the timeout is set to 40 seconds, and it was assumed that a race condition could not occur with such a delay, but it turned out that due to another error in the SMP handler, an immediate timer call could be achieved, resulting in a race condition. The issue in l2cap_le_connect_req can lead to kernel memory leakage, and l2cap_connect can result in memory content being overwritten and the execution of the attacker's code. The first attack variant can be carried out using Bluetooth LE 4.0 (since 2009), while the second can be done using Bluetooth BR/EDR 5.2 (since 2020).
The second vulnerability (CVE-2022-42895) is caused by a leakage of residual data from memory in the l2cap_parse_conf_req function, which can be exploited for remote information retrieval about pointers to kernel structures by sending specially crafted configuration requests. In the l2cap_parse_conf_req function, an l2cap_conf_efs structure was used without proper initialization of the allocated memory, and by manipulating the FLAG_EFS_ENABLE flag, it was possible to include old data from the stack in the packet. The issue manifests only in systems where the kernel is built with the CONFIG_BT_HS option (disabled by default but enabled in some distributions, such as Ubuntu). A successful attack also requires setting the HCI_HS_ENABLED parameter via the control interface to true (not used by default).
Source: opennet.ru
