CVE-2023-54210: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: Avoid use-after-free in dbg for hciremoveadvmonitor()
KASAN reports that there's a use-after-free in hciremoveadvmonitor(). Trawling through the disassembly, you can see that the complaint is from the access in btdevdbg() under the HCIADVMONITOREXTMSFT case. The problem case happens because msftremovemonitor() can end up freeing the monitor structure. Specifically: hciremoveadvmonitor() -> msftremovemonitor() -> msftremovemonitorsync() -> msftlecancelmonitoradvertisementcb() -> hcifreeadvmonitor()
Let's fix the problem by just stashing the relevant data when it's still valid.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54210?
CVE-2023-54210 has been assigned a severity level that may vary based on the specific version of the Linux kernel affected.
How do I fix CVE-2023-54210?
To resolve CVE-2023-54210, you should update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2023-54210?
CVE-2023-54210 affects certain versions of the Linux kernel that implement Bluetooth functionality.
What type of vulnerability is CVE-2023-54210?
CVE-2023-54210 is categorized as a use-after-free vulnerability within the Bluetooth subsystem of the Linux kernel.
Is CVE-2023-54210 exploitability high?
The exploitability of CVE-2023-54210 largely depends on the system configuration and whether Bluetooth is in use.