CVE-2023-53828 (GCVE-0-2023-53828)
Vulnerability from cvelistv5
Published
2025-12-09 01:29
Modified
2026-08-05 09:16
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() KSAN reports use-after-free in hci_add_adv_monitor(). While adding an adv monitor, hci_add_adv_monitor() calls -> msft_add_monitor_pattern() calls -> msft_add_monitor_sync() calls -> msft_le_monitor_advertisement_cb() calls in an error case -> hci_free_adv_monitor() which frees the *moniter. This is referenced by bt_dev_dbg() in hci_add_adv_monitor(). Fix the bt_dev_dbg() by using handle instead of monitor->handle.
References
Impacted products
Vendor Product Version
Linux Linux Version: b747a83690c8f53bc7a3f75899415c699b2c51aa
Version: b747a83690c8f53bc7a3f75899415c699b2c51aa
Version: b747a83690c8f53bc7a3f75899415c699b2c51aa
Version: b747a83690c8f53bc7a3f75899415c699b2c51aa
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81d8e9f59df63b8358751c1ffed9f1cf5c796909",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "aafda69d4807f5edf3558c9534be9b911774e63a",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "8d66f7ced51cb924bc90278d6a0a26a52877271a",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "a2bcd2b63271a93a695fabbfbf459c603d956d48",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n    hci_add_adv_monitor() calls -\u003e\n    msft_add_monitor_pattern() calls -\u003e\n    msft_add_monitor_sync() calls -\u003e\n    msft_le_monitor_advertisement_cb() calls in an error case -\u003e\n    hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor-\u003ehandle."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through a local `AF_BLUETOOTH`/`BTPROTO_HCI` management socket issuing `MGMT_OP_ADD_ADV_PATTERNS_MONITOR{,_RSSI}`; the freeing condition is the local controller\u0027s HCI command-complete status, which no remote or adjacent Bluetooth peer can drive.\nAC:L - The attacker deterministically produces the error status by submitting monitors the controller rejects (exceeding its MSFT monitor capacity or invalid RSSI thresholds), or by emulating the controller via vhci, so no condition outside their control is required.\nPR:L - The mgmt control channel requires a trusted socket (`CAP_NET_ADMIN` at bind), which in real deployments is held by an unprivileged system Bluetooth daemon (`bluetoothd` user, Android bluetooth uid) rather than full root, matching the PR:L scoring used for the identical mgmt adv-monitor UAF path.\nUI:N - The attacker triggers the whole sequence by sending management commands on its own socket; no action by any other user or victim is needed.\nS:U - The freed object and the dereference both live in kernel heap within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `struct adv_monitor` is read after free from a sprayable kmalloc-64 slab, and the same freed handle field is propagated out to userspace in the mgmt command-complete reply, disclosing reclaimed kernel heap contents.\nI:H - The use-after-free leaves an attacker-reclaimable freed object referenced by the kernel, and heap grooming of that slab can be leveraged into corruption of adjacent/reclaimed state and control-flow influence.\nA:H - Dereferencing freed slab memory reliably oopses under KASAN or hardened allocators and can panic the kernel when the backing page has been returned, and the condition is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:17.964Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"
        },
        {
          "url": "https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"
        }
      ],
      "title": "Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53828",
    "datePublished": "2025-12-09T01:29:42.166Z",
    "dateReserved": "2025-12-09T01:27:17.825Z",
    "dateUpdated": "2026-08-05T09:16:17.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.