A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add() hci_sock_blacklist_del() hci_get_conn_info() hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

🗓️ 25 Aug 2021 07:00:00Reported by MicrosoftType

Use-after-free in the Linux kernel host controller interface ioctl handling enables local privilege escalation via a race with unregister and blacklist calls.

Reporter	Title	Published	Views	Family All 327
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	22 Nov 202206:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is using components with known vulnerabilities	31 Mar 202214:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus	29 Jun 202223:37	–	ibm
ATTACKERKB	CVE-2021-3573	13 Aug 202114:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : kernel, --advisory ALAS2-2021-1685 (ALAS-2021-1685)	16 Jul 202100:00	–	nessus
Tenable Nessus	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	2 May 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-004 (ALASKERNEL-5.4-2022-004)	2 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : kernel (ALSA-2021:4356)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : kernel-rt (CESA-2021:4140)	11 Nov 202100:00	–	nessus