Описание
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
iso_get_sock() returns the parent socket with a reference held, which is
dropped by sock_put() once the child socket has been set up. The error
path taken when iso_sock_alloc() fails only calls release_sock() and
returns, leaking the reference and thus the parent socket itself.
Drop the reference on that path as well.
A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user or adjacent attacker to cause a Denial of Service (DoS) by triggering a resource leak. When handling Bluetooth Isochronous (ISO) connections, the kernel fails to release a reference to the parent socket if child socket allocation fails. Over time, repeated failures cause kernel memory to remain allocated, potentially leading to system resource exhaustion.
Отчет
A moderate severity flaw in the Linux kernel's Bluetooth ISO (Isochronous) connection handling affects Red Hat Enterprise Linux 9 (9.6 and later), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL 9 CoreOS (4.19 and later). When an ISO connection becomes ready, iso_conn_ready() takes a reference on the parent socket via iso_get_sock(); if the subsequent child socket allocation (iso_sock_alloc()) fails, the error path releases the socket lock but never drops that reference with sock_put(), leaking the parent socket and its associated kernel memory. A local user or an adjacent Bluetooth peer can trigger this path, and repeated failures accumulate leaked kernel memory, potentially leading to resource exhaustion and a denial of service. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Practical exploitability is limited: triggering the leak requires a GFP_ATOMIC child socket allocation failure under memory pressure, which an attacker cannot reliably control, and the demonstrated impact is limited resource retention rather than reliable system-wide exhaustion; for this reason the severity was reconciled down from an initial automated HIGH estimate. Older Red Hat Enterprise Linux 6, 7, and 8 streams, RHEL 9.2 and 9.4, their kernel-rt counterparts, and OpenShift releases based on RHEL 8 CoreOS are not affected because the code that introduced this flaw is not present in those kernels. The fix for the affected streams is deferred and will be delivered in a future planned update; the residual risk is gradual kernel memory consumption on systems where Bluetooth ISO connections are repeatedly established while child socket allocation fails, which over time could degrade system availability.
Меры по смягчению последствий
This flaw is reachable only through the Bluetooth subsystem, so systems that do not require Bluetooth can mitigate it by disabling Bluetooth. To unload Bluetooth until the next reboot, run as root:
modprobe -r bluetooth
To prevent the Bluetooth module from being loaded at boot time, create /etc/modprobe.d/disable-bluetooth.conf containing: blacklist bluetooth Bluetooth may also be disabled in the system firmware/BIOS settings where supported. Systems that require Bluetooth functionality have no mitigation other than applying a kernel that contains the fix once it is released for their stream.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well.
In the Linux kernel, the following vulnerability has been resolved: B ...
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well.
5.5 Medium
CVSS3