CVE-2023-1989: Use After Free
A use-after-free flaw was found in btsdioremove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdioremove with an unfinished job, may cause a race condition, and lead to a UAF problem on the hdev devices.
This bug has been submitted to upstream and got fixed in [1] and [2]
[1] https://lore.kernel.org/all/167883542095.4543.7797236411801708072.git-patchwork-notify@kernel.org/ [2] https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088
Other sources
A use-after-free flaw was found in btsdioremove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdioremove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.
— Launchpad
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a use-after-free flaw in btsdioremove function in drivers\bluetooth\btsdio.c. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1989?
The severity of CVE-2023-1989 is categorized as high due to its use-after-free vulnerability that can lead to a race condition.
How do I fix CVE-2023-1989?
To fix CVE-2023-1989, update to the latest kernel version, specifically versions 6.3 or higher, or the recommended updates from your operating system vendor.
Which systems are affected by CVE-2023-1989?
CVE-2023-1989 affects Linux Kernel versions between 2.6.24 and 6.3, as well as certain IBM Security Verify Governance products.
What causes the CVE-2023-1989 vulnerability?
The CVE-2023-1989 vulnerability is caused by a use-after-free flaw in the btsdio_remove function that can occur when there is an unfinished job with hdev devices.
What should I do if I cannot apply the patch for CVE-2023-1989 immediately?
If you cannot apply the patch for CVE-2023-1989 immediately, be sure to limit access to affected systems and monitor for signs of exploitation.