Cloudanix VulnDB

CVE-2022-48982

None

CVSS

—

EPSS

0.2%

Published

Oct 21, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Certain fake Bluetooth adapters can crash a computer running Linux when they are plugged in again after being removed.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double registration of the suspend notifier during hci_register_dev for fake CSR 5.0 Bluetooth controllers triggers a kernel panic via blocking_notifier_chain_register in btusb_probe.

Why it matters to the business

Linux systems using affected Bluetooth hardware experience sudden kernel crashes and reboots when fake controllers are reconnected, causing unplanned downtime and loss of Bluetooth functionality until reboot.

How an attack unfolds

An attacker with physical access prepares a fake CSR 5.0 clone controller and repeatedly plugs it into a vulnerable Linux system; the btusb driver registers the suspend notifier twice, leading to the panic shown in the call trace during usb_new_device and hub_event processing.

How to fix it

Apply the upstream fix that prevents duplicate suspend notifier registration in hci_register_dev; rebuild and deploy the patched kernel. Monitor for any downstream package updates that include commit 3c551261d0e230635774798009951fa83a07cc3a equivalents where applicable.

How to confirm the fix worked

Confirm the patched kernel no longer calls blocking_notifier_chain_register twice on replug; reproduce the scenario with a CSR clone and verify absence of the -17 probe error and panic trace.

Typical attack path

  1. Locate a Linux host with the vulnerable bluetooth and btusb modules
  2. Obtain or emulate a fake CSR 5.0 controller
  3. Insert the device to trigger initial probe
  4. Remove and replug the device to force second hci_register_dev call
  5. Trigger kernel panic and denial of service

How to detect it

Search kernel logs for the exact panic trace involving blocking_notifier_chain_register and hci_register_dev, or btusb probe failures returning error -17; inspect dmesg and journalctl for repeated usb_probe_device events on the same device path.

  • blocking_notifier_chain_register+0x33/0x60
  • hci_register_dev+0x316/0x3d0
  • btusb_probe+0x979/0xd85
  • probe of .* failed with error -17

What your security team should do

  • Prioritize kernel updates on all systems exposing Bluetooth to untrusted controllers
  • Disable Bluetooth when not required via kernel configuration or runtime blacklisting
  • Add monitoring for kernel panics containing btusb_probe or hci_register_dev symbols

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: [ 71.986122] Call Trace: [ 71.986124] <TASK> [ 71.986125] blocking_notifier_chain_register+0x33/0x60 [ 71.986130] hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da] [ 71.986154] btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477] [ 71.986159] ? __pm_runtime_set_status+0x1a9/0x300 [ 71.986162] ? ktime_get_mono_fast_ns+0x3e/0x90 [ 71.986167] usb_probe_interface+0xe3/0x2b0 [ 71.986171] really_probe+0xdb/0x380 [ 71.986174] ? pm_runtime_barrier+0x54/0x90 [ 71.986177] __driver_probe_device+0x78/0x170 [ 71.986180] driver_probe_device+0x1f/0x90 [ 71.986183] __device_attach_driver+0x89/0x110 [ 71.986186] ? driver_allows_async_probing+0x70/0x70 [ 71.986189] bus_for_each_drv+0x8c/0xe0 [ 71.986192] __device_attach+0xb2/0x1e0 [ 71.986195] bus_probe_device+0x92/0xb0 [ 71.986198] device_add+0x422/0x9a0 [ 71.986201] ? sysfs_merge_group+0xd4/0x110 [ 71.986205] usb_set_configuration+0x57a/0x820 [ 71.986208] usb_generic_driver_probe+0x4f/0x70 [ 71.986211] usb_probe_device+0x3a/0x110 [ 71.986213] really_probe+0xdb/0x380 [ 71.986216] ? pm_runtime_barrier+0x54/0x90 [ 71.986219] __driver_probe_device+0x78/0x170 [ 71.986221] driver_probe_device+0x1f/0x90 [ 71.986224] __device_attach_driver+0x89/0x110 [ 71.986227] ? driver_allows_async_probing+0x70/0x70 [ 71.986230] bus_for_each_drv+0x8c/0xe0 [ 71.986232] __device_attach+0xb2/0x1e0 [ 71.986235] bus_probe_device+0x92/0xb0 [ 71.986237] device_add+0x422/0x9a0 [ 71.986239] ? _dev_info+0x7d/0x98 [ 71.986242] ? blake2s_update+0x4c/0xc0 [ 71.986246] usb_new_device.cold+0x148/0x36d [ 71.986250] hub_event+0xa8a/0x1910 [ 71.986255] process_one_work+0x1c4/0x380 [ 71.986259] worker_thread+0x51/0x390 [ 71.986262] ? rescuer_thread+0x3b0/0x3b0 [ 71.986264] kthread+0xdb/0x110 [ 71.986266] ? kthread_complete_and_exit+0x20/0x20 [ 71.986268] ret_from_fork+0x1f/0x30 [ 71.986273] </TASK> [ 71.986274] ---[ end trace 0000000000000000 ]--- [ 71.986284] btusb: probe of 2-1.6:1.0 failed with error -17

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.162-1
Debian:12 linux 0 6.1.4-1
Debian:13 linux 0 6.1.4-1
Debian:14 linux 0 6.1.4-1
Linux Kernel 6.0.0 6.0.13
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_23 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_21 0 1-150500.11.5.1
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.88.1.150500.6.39.4
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.79.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.79.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.88.1.150500.6.39.4
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.88.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.75.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.75.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.75.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.79.1
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.79.1
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.79.1
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.79.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1031.35~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1034.41~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1034.41~20.04.1.2
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1030.37~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1016.21~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-67.74~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1026.31~20.04.1
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-67.74~20.04.1
Ubuntu:20.04:LTS linux-nvidia-tegra-5.15 0 5.15.0-1014.14~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1030.36~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1030.34~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS linux 0 5.15.0-67.74
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1031.35
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1009.9~22.04.2
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1034.41
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1034.41.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1030.37
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1010.11~22.04.1
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1028.33
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1016.21
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-38.38~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1026.29
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1026.31
Ubuntu:22.04:LTS linux-kvm 0 5.15.0-1029.34
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-67.74
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-38.38.1~22.04.2
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1023.23
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 5.15.0-1030.36
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1006.6~22.04.3
Ubuntu:22.04:LTS linux-raspi 0 5.15.0-1025.27
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-38.38.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 No fix
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.5.0-1009.9
Ubuntu:24.04:LTS linux-lowlatency 0 6.5.0-9.9.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.11 0 6.11.0-1007.7
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.5.0-1010.10
Ubuntu:24.04:LTS linux-raspi 0 6.5.0-1005.7
Ubuntu:24.04:LTS linux-raspi-realtime 0 No fix
Ubuntu:24.04:LTS linux-raspi-realtime 0 6.7.0-2001.1
Ubuntu:24.04:LTS linux-realtime 0 6.8.0-1008.19
Ubuntu:24.04:LTS linux-riscv 0 6.5.0-9.9.1
Ubuntu:24.10 linux 0 6.8.0-31.31
Ubuntu:24.10 linux-aws 0 6.8.0-1008.8
Ubuntu:24.10 linux-azure 0 6.8.0-1007.7
Ubuntu:24.10 linux-gcp 0 6.8.0-1007.7
Ubuntu:24.10 linux-lowlatency 0 6.8.0-31.31.1
Ubuntu:24.10 linux-oracle 0 6.8.0-1005.5
Ubuntu:24.10 linux-raspi 0 6.8.0-1004.4
Ubuntu:24.10 linux-realtime 0 6.11.0-1001.1
Ubuntu:24.10 linux-riscv 0 6.8.0-31.31.1
Ubuntu:Nvidia-BlueField:22.04:LTS linux-bluefield 0 5.15.0-1014.16
Ubuntu:Pro:14.04:LTS linux 0 No fix
Ubuntu:Pro:14.04:LTS linux-aws 0 No fix
Ubuntu:Pro:14.04:LTS linux-azure 0 No fix
Ubuntu:Pro:14.04:LTS linux-lts-xenial 0 No fix
Ubuntu:Pro:16.04:LTS linux 0 No fix
Ubuntu:Pro:16.04:LTS linux-aws 0 No fix
Ubuntu:Pro:16.04:LTS linux-aws-hwe 0 No fix
Ubuntu:Pro:16.04:LTS linux-azure 0 No fix
Ubuntu:Pro:16.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:16.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:16.04:LTS linux-kvm 0 No fix
Ubuntu:Pro:16.04:LTS linux-oracle 0 No fix
Ubuntu:Pro:18.04:LTS linux 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.4 0 No fix

Related vulnerabilities