CVE-2023-28464: Use After Free
A double free vulnerability was found in the hciconncleanup function of net/bluetooth/hciconn.c, which may cause DOS or privilege escalation.
Version: Linux kernel 6.2 (this problem also exists in 6.3-rc1)
At the end of the hciconndelsysfs(conn) function in the hciconncleanup function, hcidevput(hdev) will be called. The hcidevput function will eventually call kfree to release the space used by name:
hcidevput putdevice kobjectput krefput kobjectrelease kobjectcleanup kfreeconst kfree
After the hciconndelsysfs function ends, the hcidevput function is called again in the hciconncleanup function, and their parameters hdev are the same, so double free will be caused when the name is released.
In addition, at the end of hciconncleanup, the hciconnput function is called again, which will call the putdevice function to release conn->dev. Obviously conn->dev has been released, so there will also be a double free problem here.
Call Trace from syzbot, https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419:
Other sources
hciconncleanup in net/bluetooth/hciconn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hciconnhashflush) because of calls to hcidevput and hciconnput. There is a double free that may lead to privilege escalation.
— MITRE
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a double free flaw in the hciconncleanup function in the Bluetooth subsystem. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-28464.
What is the severity level of CVE-2023-28464?
CVE-2023-28464 has a severity level of 7.8, which is considered high.
Which software versions are affected by CVE-2023-28464?
The Linux kernel versions 6.1.25, 6.2.12, 6.3, and all release candidates (6.3-rc1 to 6.3-rc6) are affected by CVE-2023-28464. Additionally, Netapp Baseboard Management Controller firmware versions H300s, H410c, H410s, H500s, and H700s are also affected.
What is the description of CVE-2023-28464?
CVE-2023-28464 is a use-after-free vulnerability in the Linux kernel's hci_conn_cleanup function that can lead to privilege escalation due to a double free issue.
How can I fix CVE-2023-28464?
To fix CVE-2023-28464, it is recommended to apply the relevant patch or update provided by the Linux kernel or Netapp, depending on the affected software version.