CVE-2021-32399: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-32399 is a race condition vulnerability discovered in the Linux kernel through version 5.12.2, specifically in the net/bluetooth/hci_request.c file affecting the HCI controller removal process. The vulnerability was discovered by the BlockSec team and was publicly disclosed on May 10, 2021 (Openwall List).

The vulnerability stems from a race condition between issuing a command to the Bluetooth controller and unregistering the Bluetooth controller. The race occurs when thread-A is issuing a command while thread-B is attempting to close the device, potentially leading to a use-after-free condition of slab objects. The issue manifests when thread-B obtains the sync lock (hdev->req_lock) before thread-A, allowing thread-A to obtain the sync lock even after thread-B has closed the HCI device. This vulnerability has been assigned a CVSS v3.1 base score of 7.0 (HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to use-after-free conditions, potentially resulting in denial of service (crash or memory corruption), information disclosure, or privilege escalation. Through heap spraying techniques, attackers could potentially achieve arbitrary memory write primitives or RIP hijacking due to the presence of multiple pointers in the hdev object (Openwall List).

The vulnerability can be exploited through three potential methods: using the virtual HCI driver (vhci), using ptmx to act as an HCI TTY device, or using real devices. While the vhci method requires root privileges, the ptmx method requires CAP_NET_ADMIN privilege. The vulnerability has been successfully demonstrated in a QEMU environment, and proof-of-concept code has been developed (Openwall List).

The vulnerability was patched in the Linux kernel through commit e2cb6b891ad2b8caa9131e3be70f45243df82a80, which modifies the sequence in the hci_req_sync() function to prevent thread-A from issuing commands after the device is closed. The fix involves checking the HCI_UP flag after obtaining the lock to protect against races from hci_dev_do_close when the controller gets removed (Kernel Commit).

Multiple Linux distributions and vendors have acknowledged and addressed this vulnerability. Debian included fixes in their security updates DLA-2689-1 and DLA-2690-1 (Debian LTS). NetApp has also acknowledged the vulnerability's impact on several of their products and has provided specific remediation guidance for affected systems (NetApp Advisory).