Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49474Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.18.5-1DEBIAN-CVE-2022-49474
Debian:13linux5.18.5-1DEBIAN-CVE-2022-49474
Debian:14linux5.18.5-1DEBIAN-CVE-2022-49474
Ubuntu:22.04:LTSlinux5.15.0-47.51UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-aws5.15.0-1019.23UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-azure5.15.0-1019.24UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-gcp5.15.0-1017.23UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-gke5.15.0-1015.18UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1002.4UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-ibm5.15.0-1013.15UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1015.20UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-kvm5.15.0-1017.21UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-47.53UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-oracle5.15.0-1017.22UBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-raspi5.15.0-1014.16UBUNTU-CVE-2022-49474
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49474
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49474

Affected products (as reported)

VendorProductVersions
Linux Linux 22c66af08230a7030bdb88accffaec3424695631 – before 9de3dc09e56f8deacd2bdbf4cecb71e11a3124050115a66ebb44bd9127ccb58cf43ed23c795eb1f0 – before 7d61dbd7311ab978d8ddac1749a758de4de00374bc4b08383046f3282b6fa58cfcef05bd13e52b93 – before 390d82733a953c1fabf3de9c9618091a7a9c90a65ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7 – before 6f55fac0af3531cf60d11369454c41f5fc81ab3f059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75 – before 36c644c63bfcaee2d3a426f45e89a9cd09799318e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 – before 65d347cb39e2e6bd0c2a745ad7c928998ebb0162e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 – before 537f619dea4e3fa8ed1f8f938abffe3615794bcce1dee2c1de2b4dd00eb44004a4bda6326ed07b59 – before 99df16007f4bbf9abfc3478cb17d10f0d7f8906e
Linux Linux 5.15

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References