CVE-2022-42896: Linux Kernel Bluetooth UAF Vulnerability

CVE-2022-42896 Overview

CVE-2022-42896 identifies critical use-after-free vulnerabilities in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) subsystem. The vulnerabilities exist within the l2cap_connect and l2cap_le_connect_req functions located in net/bluetooth/l2cap_core.c. These flaws can be exploited by remote attackers within Bluetooth proximity to achieve code execution or leak sensitive kernel memory.

The vulnerability allows an attacker with adjacent network access via Bluetooth to potentially execute arbitrary code or extract confidential kernel memory contents. This represents a significant security risk for systems with Bluetooth enabled and exposed to untrusted environments.

Critical Impact

Remote attackers within Bluetooth range can exploit these use-after-free conditions to execute arbitrary code or leak kernel memory, potentially leading to complete system compromise without requiring authentication or user interaction.

Affected Products

• Linux Kernel (multiple versions with vulnerable Bluetooth L2CAP implementation)
• Systems running Linux with Bluetooth functionality enabled
• Devices using the affected net/bluetooth/l2cap_core.c implementation

Discovery Timeline

• 2022-11-23 - CVE CVE-2022-42896 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-42896

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption flaw where the application continues to reference memory after it has been freed. In the context of CVE-2022-42896, the Linux kernel's Bluetooth L2CAP implementation improperly handles connection requests, leading to use-after-free conditions in two key functions.

The l2cap_connect and l2cap_le_connect_req functions fail to properly validate incoming connection parameters before processing. Specifically, the vulnerability stems from improper handling of the Protocol/Service Multiplexer (PSM) values during Bluetooth Low Energy credit-based connection requests. When invalid SPSM (Simplified Protocol/Service Multiplexer) values are accepted, the kernel can reference freed memory structures, creating an exploitable condition.

An adjacent attacker within Bluetooth radio range can craft malicious L2CAP connection requests to trigger these use-after-free conditions. Successful exploitation can result in arbitrary code execution within the kernel context or information disclosure through kernel memory leaks.

Root Cause

The root cause is insufficient input validation of the PSM parameter in the L2CAP connection handling code. According to the Bluetooth Core Specification Version 5.3, Volume 3, Part A, the valid range for SPSM values in L2CAP_LE_CREDIT_BASED_CONNECTION_REQ should be 0x0001-0x00ff. The vulnerable code failed to enforce this boundary, accepting invalid or zero PSM values that could lead to improper memory access patterns and use-after-free conditions.

Attack Vector

The attack vector requires adjacent network access via Bluetooth. An attacker must be within Bluetooth radio range of the target device (typically up to 100 meters for Class 1 devices). The attack does not require authentication or user interaction, making it particularly dangerous in public environments or shared workspaces where Bluetooth is commonly enabled.

The attacker can send specially crafted L2CAP connection request packets with invalid SPSM values to trigger the vulnerability. Since Bluetooth operates at the link layer, traditional network-based security controls are ineffective against this attack vector.

 	BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
 	       scid, mtu, mps);

+	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
+	 * page 1059:
+	 *
+	 * Valid range: 0x0001-0x00ff
+	 *
+	 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
+	 */
+	if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
+		result = L2CAP_CR_LE_BAD_PSM;
+		chan = NULL;
+		goto response;
+	}
+
 	/* Check if we have socket listening on psm */
 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
 				 &conn->hcon->dst, LE_LINK);

Source: GitHub Linux Commit

Detection Methods for CVE-2022-42896

Indicators of Compromise

• Unusual Bluetooth L2CAP connection attempts with malformed or invalid PSM values
• Kernel crashes or panics related to Bluetooth subsystem memory access violations
• Unexpected memory access patterns in l2cap_core.c functions observed through kernel debugging
• System instability following Bluetooth device pairing attempts from unknown devices

Detection Strategies

• Monitor kernel logs for Bluetooth-related OOPS, panics, or use-after-free warnings in the L2CAP subsystem
• Deploy endpoint detection solutions capable of monitoring kernel-level Bluetooth activity for anomalies
• Implement Bluetooth traffic analysis to detect malformed L2CAP connection requests
• Use kernel address sanitizer (KASAN) in development/testing environments to detect use-after-free conditions

Monitoring Recommendations

• Enable comprehensive kernel logging for the Bluetooth subsystem (CONFIG_BT_DEBUG)
• Implement alerting for repeated failed Bluetooth connection attempts from the same MAC address
• Monitor system stability metrics and correlate any crashes with Bluetooth activity
• Deploy network security monitoring tools capable of analyzing Bluetooth protocol traffic in enterprise environments

How to Mitigate CVE-2022-42896

Immediate Actions Required

• Update the Linux kernel to a version containing commit 711f8c3fb3db61897080468586b970c87c61d9e4
• Disable Bluetooth functionality on systems where it is not required
• Restrict physical access to high-security systems to limit Bluetooth proximity attacks
• Implement Bluetooth device whitelisting where supported to reject connections from unknown devices

Patch Information

The vulnerability has been addressed in the official Linux kernel through commit 711f8c3fb3db61897080468586b970c87c61d9e4. This patch adds proper validation of the SPSM range according to the Bluetooth Core Specification Version 5.3, rejecting connection requests with invalid PSM values before they can trigger the use-after-free condition.

Organizations should upgrade to patched kernel versions available through their Linux distribution's security update channels. Refer to the GitHub Linux Commit and Kernel Dance Reference for technical details on the fix.

Workarounds

• Disable Bluetooth at the kernel level by blacklisting Bluetooth modules (blacklist btusb, blacklist bluetooth)
• Use hardware Bluetooth disable switches if available on the device
• Implement network segmentation and physical security controls to limit attacker proximity
• Deploy endpoint protection solutions with kernel-level monitoring capabilities

# Configuration example - Disable Bluetooth modules
echo "blacklist btusb" >> /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist bluetooth" >> /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btrtl" >> /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btbcm" >> /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btintel" >> /etc/modprobe.d/blacklist-bluetooth.conf

# Apply changes
update-initramfs -u
systemctl stop bluetooth
systemctl disable bluetooth