CVE-2022-49474
Estado: AnalizadaAlta (7.8)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
Detalles técnicos trazas, registros y código del informe original
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.28%
- Percentil entre todas las CVEs puntuadas: 19
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation85 % - Impacto principal
T1059Command and Scripting Interpreterexecution70 %
Vuln. local (AV:L, PR:L) sin interacción: escalada por race condition en Bluetooth SCO. Use-after-free puede permitir ejecución de código.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-416
Referencias
- https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318
- https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6
- https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc
- https://git.kernel.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162
- https://git.kernel.org/stable/c/6f55fac0af3531cf60d11369454c41f5fc81ab3f
- https://git.kernel.org/stable/c/7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2
- https://git.kernel.org/stable/c/7d61dbd7311ab978d8ddac1749a758de4de00374
- https://git.kernel.org/stable/c/99df16007f4bbf9abfc3478cb17d10f0d7f8906e
- https://git.kernel.org/stable/c/9de3dc09e56f8deacd2bdbf4cecb71e11a312405
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-49474",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-49474",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-27T18:15:54.463749Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "22c66af08230a7030bdb88accffaec3424695631",
"lessThan": "9de3dc09e56f8deacd2bdbf4cecb71e11a312405",
"versionType": "git"
},
{
"status": "affected",
"version": "0115a66ebb44bd9127ccb58cf43ed23c795eb1f0",
"lessThan": "7d61dbd7311ab978d8ddac1749a758de4de00374",
"versionType": "git"
},
{
"status": "affected",
"version": "bc4b08383046f3282b6fa58cfcef05bd13e52b93",
"lessThan": "390d82733a953c1fabf3de9c9618091a7a9c90a6",
"versionType": "git"
},
{
"status": "affected",
"version": "5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7",
"lessThan": "6f55fac0af3531cf60d11369454c41f5fc81ab3f",
"versionType": "git"
},
{
"status": "affected",
"version": "059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75",
"lessThan": "36c644c63bfcaee2d3a426f45e89a9cd09799318",
"versionType": "git"
},
{
"status": "affected",
"version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
"lessThan": "65d347cb39e2e6bd0c2a745ad7c928998ebb0162",
"versionType": "git"
},
{
"status": "affected",
"version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
"lessThan": "537f619dea4e3fa8ed1f8f938abffe3615794bcc",
"versionType": "git"
},
{
"status": "affected",
"version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
"lessThan": "99df16007f4bbf9abfc3478cb17d10f0d7f8906e",
"versionType": "git"
},
{
"status": "affected",
"version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
"lessThan": "7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2",
"versionType": "git"
},
{
"status": "affected",
"version": "98ae477ed1540d3acbbf44d88ee237ad64275158",
"versionType": "git"
},
{
"status": "affected",
"version": "f0c389e23e2475e5837716a629c81b7a9d90cc94",
"versionType": "git"
},
{
"status": "affected",
"version": "0b9da4bde0d59c61b3675bdd80a05a726beb875a",
"versionType": "git"
},
{
"status": "affected",
"version": "4.9.283",
"lessThan": "4.9.318",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.247",
"lessThan": "4.14.283",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.207",
"lessThan": "4.19.247",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.146",
"lessThan": "5.4.198",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.65",
"lessThan": "5.10.121",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.4.284",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.13.17",
"lessThan": "5.14",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.14.4",
"lessThan": "5.15",
"versionType": "semver"
}
],
"programFiles": [
"net/bluetooth/sco.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.9.318",
"versionType": "semver",
"lessThanOrEqual": "4.9.*"
},
{
"status": "unaffected",
"version": "4.14.283",
"versionType": "semver",
"lessThanOrEqual": "4.14.*"
},
{
"status": "unaffected",
"version": "4.19.247",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.198",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.121",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.46",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "5.17.14",
"versionType": "semver",
"lessThanOrEqual": "5.17.*"
},
{
"status": "unaffected",
"version": "5.18.3",
"versionType": "semver",
"lessThanOrEqual": "5.18.*"
},
{
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/sco.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-02-26T07:01:23.613",
"references": [
{
"url": "https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6f55fac0af3531cf60d11369454c41f5fc81ab3f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7d61dbd7311ab978d8ddac1749a758de4de00374",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/99df16007f4bbf9abfc3478cb17d10f0d7f8906e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9de3dc09e56f8deacd2bdbf4cecb71e11a312405",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout\n\nConnecting the same socket twice consecutively in sco_sock_connect()\ncould lead to a race condition where two sco_conn objects are created\nbut only one is associated with the socket. If the socket is closed\nbefore the SCO connection is established, the timer associated with the\ndangling sco_conn object won't be canceled. As the sock object is being\nfreed, the use-after-free problem happens when the timer callback\nfunction sco_sock_timeout() accesses the socket. Here's the call trace:\n\ndump_stack+0x107/0x163\n? refcount_inc+0x1c/\nprint_address_description.constprop.0+0x1c/0x47e\n? refcount_inc+0x1c/0x7b\nkasan_report+0x13a/0x173\n? refcount_inc+0x1c/0x7b\ncheck_memory_region+0x132/0x139\nrefcount_inc+0x1c/0x7b\nsco_sock_timeout+0xb2/0x1ba\nprocess_one_work+0x739/0xbd1\n? cancel_delayed_work+0x13f/0x13f\n? __raw_spin_lock_init+0xf0/0xf0\n? to_kthread+0x59/0x85\nworker_thread+0x593/0x70e\nkthread+0x346/0x35a\n? drain_workqueue+0x31a/0x31a\n? kthread_bind+0x4b/0x4b\nret_from_fork+0x1f/0x30"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: se corrige el sco_conn colgante y el use-after-free en sco_sock_timeout Conectar el mismo socket dos veces consecutivas en sco_sock_connect() podría provocar una condición de ejecución en la que se crean dos objetos sco_conn pero solo uno está asociado con el socket. Si el socket se cierra antes de que se establezca la conexión SCO, el temporizador asociado con el objeto sco_conn colgante no se cancelará. A medida que se libera el objeto sock, el problema de use-after-free ocurre cuando la función de devolución de llamada del temporizador sco_sock_timeout() accede al socket. Aquí está el seguimiento de la llamada: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30 "
}
],
"lastModified": "2026-06-17T05:18:09.760",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA737495-79C0-44E9-9460-1B952324539D",
"versionEndExcluding": "4.5",
"versionStartIncluding": "4.4.284"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00BEF9C7-A165-4F9C-AB25-957923C10777",
"versionEndExcluding": "4.9.318",
"versionStartIncluding": "4.9.238"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04E6F3D8-9994-4BD6-AC78-979F4425C845",
"versionEndExcluding": "4.14.283",
"versionStartIncluding": "4.14.247"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D758AE59-1429-4455-9E8F-244E41414654",
"versionEndExcluding": "4.19.247",
"versionStartIncluding": "4.19.207"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10513E44-520A-4056-98BE-E9AAC07D6139",
"versionEndExcluding": "5.4.198",
"versionStartIncluding": "5.4.146"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54DD05A3-4198-4FF8-9B37-4C8B5C038E64",
"versionEndExcluding": "5.10.121",
"versionStartIncluding": "5.10.65"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0547757C-4CB4-47A0-A6C4-2C6CDEA08791",
"versionEndExcluding": "5.14",
"versionStartIncluding": "5.13.17"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCE27D56-8FE9-4B2F-93FE-BCAB349E9E3F",
"versionEndExcluding": "5.15.46",
"versionStartIncluding": "5.14.4"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
"versionEndExcluding": "5.17.14",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
"versionEndExcluding": "5.18.3",
"versionStartIncluding": "5.18"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}