{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa16cac06b752e5f609c106735bd7838f444784c",
              "status": "affected",
              "version": "4d7ea8ee90e42fc75995f6fb24032d3233314528",
              "versionType": "git"
            },
            {
              "lessThan": "5b4f039a2f487c5edae681d763fe1af505f84c13",
              "status": "affected",
              "version": "4d7ea8ee90e42fc75995f6fb24032d3233314528",
              "versionType": "git"
            },
            {
              "lessThan": "7c9524d929648935bac2bbb4c20437df8f9c3f42",
              "status": "affected",
              "version": "4d7ea8ee90e42fc75995f6fb24032d3233314528",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.78",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.8",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix memory leak in vhci_write\n\nSyzkaller reports a memory leak as follows:\n====================================\nBUG: memory leak\nunreferenced object 0xffff88810d81ac00 (size 240):\n  [...]\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff838733d9\u003e] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:418\n    [\u003cffffffff833f742f\u003e] alloc_skb include/linux/skbuff.h:1257 [inline]\n    [\u003cffffffff833f742f\u003e] bt_skb_alloc include/net/bluetooth/bluetooth.h:469 [inline]\n    [\u003cffffffff833f742f\u003e] vhci_get_user drivers/bluetooth/hci_vhci.c:391 [inline]\n    [\u003cffffffff833f742f\u003e] vhci_write+0x5f/0x230 drivers/bluetooth/hci_vhci.c:511\n    [\u003cffffffff815e398d\u003e] call_write_iter include/linux/fs.h:2192 [inline]\n    [\u003cffffffff815e398d\u003e] new_sync_write fs/read_write.c:491 [inline]\n    [\u003cffffffff815e398d\u003e] vfs_write+0x42d/0x540 fs/read_write.c:578\n    [\u003cffffffff815e3cdd\u003e] ksys_write+0x9d/0x160 fs/read_write.c:631\n    [\u003cffffffff845e0645\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    [\u003cffffffff845e0645\u003e] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n    [\u003cffffffff84600087\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n====================================\n\nHCI core will uses hci_rx_work() to process frame, which is queued to\nthe hdev-\u003erx_q tail in hci_recv_frame() by HCI driver.\n\nYet the problem is that, HCI core may not free the skb after handling\nACL data packets. To be more specific, when start fragment does not\ncontain the L2CAP length, HCI core just copies skb into conn-\u003erx_skb and\nfinishes frame process in l2cap_recv_acldata(), without freeing the skb,\nwhich triggers the above memory leak.\n\nThis patch solves it by releasing the relative skb, after processing\nthe above case in l2cap_recv_acldata()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:48:26.680Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa16cac06b752e5f609c106735bd7838f444784c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b4f039a2f487c5edae681d763fe1af505f84c13"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c9524d929648935bac2bbb4c20437df8f9c3f42"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix memory leak in vhci_write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49908",
    "datePublished": "2025-05-01T14:10:51.706Z",
    "dateReserved": "2025-05-01T14:05:17.247Z",
    "dateUpdated": "2025-05-04T08:48:26.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49908\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:15.920\",\"lastModified\":\"2025-05-02T13:52:51.693\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: L2CAP: Fix memory leak in vhci_write\\n\\nSyzkaller reports a memory leak as follows:\\n====================================\\nBUG: memory leak\\nunreferenced object 0xffff88810d81ac00 (size 240):\\n  [...]\\n  hex dump (first 32 bytes):\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n  backtrace:\\n    [\u003cffffffff838733d9\u003e] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:418\\n    [\u003cffffffff833f742f\u003e] alloc_skb include/linux/skbuff.h:1257 [inline]\\n    [\u003cffffffff833f742f\u003e] bt_skb_alloc include/net/bluetooth/bluetooth.h:469 [inline]\\n    [\u003cffffffff833f742f\u003e] vhci_get_user drivers/bluetooth/hci_vhci.c:391 [inline]\\n    [\u003cffffffff833f742f\u003e] vhci_write+0x5f/0x230 drivers/bluetooth/hci_vhci.c:511\\n    [\u003cffffffff815e398d\u003e] call_write_iter include/linux/fs.h:2192 [inline]\\n    [\u003cffffffff815e398d\u003e] new_sync_write fs/read_write.c:491 [inline]\\n    [\u003cffffffff815e398d\u003e] vfs_write+0x42d/0x540 fs/read_write.c:578\\n    [\u003cffffffff815e3cdd\u003e] ksys_write+0x9d/0x160 fs/read_write.c:631\\n    [\u003cffffffff845e0645\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n    [\u003cffffffff845e0645\u003e] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\\n    [\u003cffffffff84600087\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n====================================\\n\\nHCI core will uses hci_rx_work() to process frame, which is queued to\\nthe hdev-\u003erx_q tail in hci_recv_frame() by HCI driver.\\n\\nYet the problem is that, HCI core may not free the skb after handling\\nACL data packets. To be more specific, when start fragment does not\\ncontain the L2CAP length, HCI core just copies skb into conn-\u003erx_skb and\\nfinishes frame process in l2cap_recv_acldata(), without freeing the skb,\\nwhich triggers the above memory leak.\\n\\nThis patch solves it by releasing the relative skb, after processing\\nthe above case in l2cap_recv_acldata().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: L2CAP: Se corrige la p\u00e9rdida de memoria en vhci_write Syzkaller informa de una p\u00e9rdida de memoria de la siguiente manera: ===================================== ERROR: p\u00e9rdida de memoria del objeto no referenciado 0xffff88810d81ac00 (tama\u00f1o 240): [...] volcado hexadecimal (primeros 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:418 [] alloc_skb include/linux/skbuff.h:1257 [en l\u00ednea] [] bt_skb_alloc include/net/bluetooth/bluetooth.h:469 [en l\u00ednea] [] vhci_get_user drivers/bluetooth/hci_vhci.c:391 [en l\u00ednea] [] vhci_write+0x5f/0x230 drivers/bluetooth/hci_vhci.c:511 [] call_write_iter include/linux/fs.h:2192 [en l\u00ednea] [] new_sync_write fs/read_write.c:491 [en l\u00ednea] [] vfs_write+0x42d/0x540 fs/read_write.c:578 [] ksys_write+0x9d/0x160 fs/read_write.c:631 [] do_syscall_x64 arch/x86/entry/common.c:50 [en l\u00ednea] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd ====================================== El n\u00facleo HCI utiliza hci_rx_work() para procesar la trama, que el controlador HCI pone en cola en la cola hdev-\u0026gt;rx_q en hci_recv_frame(). Sin embargo, el problema es que el n\u00facleo HCI puede no liberar el skb despu\u00e9s de procesar los paquetes de datos ACL. Para ser m\u00e1s espec\u00edficos, cuando el fragmento de inicio no contiene la longitud L2CAP, el n\u00facleo HCI simplemente copia el skb en conn-\u0026gt;rx_skb y finaliza el procesamiento de la trama en l2cap_recv_acldata(), sin liberar el skb, lo que desencadena la p\u00e9rdida de memoria mencionada anteriormente. Este parche lo resuelve liberando el skb relativo, despu\u00e9s de procesar el caso mencionado en l2cap_recv_acldata().\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5b4f039a2f487c5edae681d763fe1af505f84c13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7c9524d929648935bac2bbb4c20437df8f9c3f42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa16cac06b752e5f609c106735bd7838f444784c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}