Log in Start free

Vulnerability · Published Aug 21, 2024 · Assigned by Linux

CVE-2022-48878Bluetooth: hci_qca: Fix driver shutdown on closed serdev

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Fix driver shutdown on closed serdev The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either. Also skip this step if device is powered off (qca_power_shutdown()). The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth: Unable to handle kernel paging request at virtual address 0072662f67726fd7 ... CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W 6.1.0-rt5-00325-g8a5f56bcfcca #8 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: tty_driver_flush_buffer+0x4/0x30 serdev_device_write_flush+0x24/0x34 qca_serdev_shutdown+0x80/0x130 [hci_uart] device_shutdown+0x15c/0x260 kernel_restart+0x48/0xac KASAN report: BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50 Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1 CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xdc/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x68/0x84 print_report+0x188/0x488 kasan_report+0xa4/0xf0 __asan_load8+0x80/0xac tty_driver_flush_buffer+0x1c/0x50 ttyport_write_flush+0x34/0x44 serdev_device_write_flush+0x48/0x60 qca_serdev_shutdown+0x124/0x274 device_shutdown+0x1e8/0x350 kernel_restart+0x48/0xb0 __do_sys_reboot+0x244/0x2d0 __arm64_sys_reboot+0x54/0x70 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x44/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xbc/0x140 el0t_64_sync+0x190/0x194

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.8-1DEBIAN-CVE-2022-48878
Debian:13linux6.1.8-1DEBIAN-CVE-2022-48878
Debian:14linux6.1.8-1DEBIAN-CVE-2022-48878
Ubuntu:22.04:LTSlinux5.15.0-70.77UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-aws5.15.0-1034.38UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure5.15.0-1036.43UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1036.43.1UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-gcp5.15.0-1032.40UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-gke5.15.0-1031.36UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1018.23UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-ibm5.15.0-1028.31UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1028.33UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-kvm5.15.0-1031.36UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-70.77UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-oracle5.15.0-1033.39UBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-raspi5.15.0-1027.29UBUNTU-CVE-2022-48878
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48878
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48878

Affected products (as reported)

VendorProductVersions
Linux Linux 7e7bbddd029b644f00f0ffbfbc485ed71977d0d5 – before e84ec6e25df9bb0968599e92eacedaf3a0a5b5877e7bbddd029b644f00f0ffbfbc485ed71977d0d5 – before 908d1742b6e694e84ead5c62e4b7c1bfbb8b46a37e7bbddd029b644f00f0ffbfbc485ed71977d0d5 – before ea3ebda47dd56f6e1c62f2e0e1b6e1b0a973e4477e7bbddd029b644f00f0ffbfbc485ed71977d0d5 – before 272970be3dabd24cbe50e393ffee8f04aec3b9a8
Linux Linux 5.8

References