CVE-2023-28464

Published: 31 March 2023

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

From the Ubuntu Security Team

Zhenghan Wang discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device unlink in some situations, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.

Notes

both the introducing commit 0f00cd322d22 ("Bluetooth:
Free potentially unfreed SCO connection") and the fixing commit
5dc7d23e167e ("Bluetooth: hci_conn: Fix possible UAF") were pulled
into the upstream stable v6.2.12 kernel, so 6.2.y kernel users
were never affected by this issue.
Upstream commit a85fb91e3d72 ("Bluetooth: Fix double free
in hci_conn_cleanup") (6.7-rc1) also claims to fix this CVE,
not clear if this is a typo or was a followup fix, because the
original was incomplete.

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2023/03/28/2
• https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm@gmail.com/
• https://lore.kernel.org/linux-bluetooth/20230330220332.1035910-1-luiz.dentz@gmail.com/
• https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419
• https://www.cve.org/CVERecord?id=CVE-2023-28464
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2177759
• https://bugzilla.suse.com/show_bug.cgi?id=1209052