CVE-2023-54210 (GCVE-0-2023-54210)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:11 – Updated: 2026-08-05 09:18
VLAI
Title
Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() KASAN reports that there's a use-after-free in hci_remove_adv_monitor(). Trawling through the disassembly, you can see that the complaint is from the access in bt_dev_dbg() under the HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because msft_remove_monitor() can end up freeing the monitor structure. Specifically: hci_remove_adv_monitor() -> msft_remove_monitor() -> msft_remove_monitor_sync() -> msft_le_cancel_monitor_advertisement_cb() -> hci_free_adv_monitor() Let's fix the problem by just stashing the relevant data when it's still valid.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c , < 0d4d6b083da9b033ddccef72d77f373c819ae3ea (git)
Affected: 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c , < bf00c2c8f6254f44ac041aa9a311ae9e0caf692b (git)
Affected: 7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c , < de6dfcefd107667ce2dbedf4d9337f5ed557a4a1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.42 , ≤ 6.1.* (semver)
Unaffected: 6.4.7 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d4d6b083da9b033ddccef72d77f373c819ae3ea",
              "status": "affected",
              "version": "7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c",
              "versionType": "git"
            },
            {
              "lessThan": "bf00c2c8f6254f44ac041aa9a311ae9e0caf692b",
              "status": "affected",
              "version": "7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c",
              "versionType": "git"
            },
            {
              "lessThan": "de6dfcefd107667ce2dbedf4d9337f5ed557a4a1",
              "status": "affected",
              "version": "7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there\u0027s a use-after-free in\nhci_remove_adv_monitor(). Trawling through the disassembly, you can\nsee that the complaint is from the access in bt_dev_dbg() under the\nHCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because\nmsft_remove_monitor() can end up freeing the monitor\nstructure. Specifically:\n  hci_remove_adv_monitor() -\u003e\n  msft_remove_monitor() -\u003e\n  msft_remove_monitor_sync() -\u003e\n  msft_le_cancel_monitor_advertisement_cb() -\u003e\n  hci_free_adv_monitor()\n\nLet\u0027s fix the problem by just stashing the relevant data when it\u0027s\nstill valid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through a local `AF_BLUETOOTH` HCI control socket carrying `MGMT_OP_REMOVE_ADV_MONITOR` (or via bluetoothd acting on a local D-Bus client); no Bluetooth peer, radio frame, or network packet participates in triggering the free-then-read.\nAC:L - The attacker deterministically drives the sequence by adding an advertisement monitor and then removing it \u2014 no race must be won, and on MSFT-capable controllers (Intel/Realtek/Qualcomm/MediaTek, i.e. most real hardware) the offending branch is the default path.\nPR:L - The mgmt handler nominally requires a trusted socket, but on stock Linux/ChromeOS systems an unprivileged local user drives the exact same add/remove monitor sequence through BlueZ\u0027s AdvertisementMonitorManager1 D-Bus interface, and monitors are auto-removed when the unprivileged client disconnects.\nUI:N - The attacking process performs the register/unregister sequence itself; no victim action, mount, or file open is needed.\nS:U - The freed object, the stale read, and the resulting impact all live in the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a freed slab object whose contents can be groomed during the sleeping `msft_remove_addr_filters_sync()` window, and the recycled heap contents are emitted into the kernel log \u2014 a repeatable heap-disclosure primitive usable against KASLR.\nI:H - Use-after-free of a `struct adv_monitor` with an attacker-influenceable reallocation window is a memory-corruption class defect; the dangling reference to a reclaimed slab object is the standard building block for heap-spray driven corruption.\nA:H - Dereferencing the freed monitor oopses the kernel when the backing slab page has been returned to the page allocator or under KASAN/panic_on_warn, and the sequence can be repeated at will to crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:04.882Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d4d6b083da9b033ddccef72d77f373c819ae3ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf00c2c8f6254f44ac041aa9a311ae9e0caf692b"
        },
        {
          "url": "https://git.kernel.org/stable/c/de6dfcefd107667ce2dbedf4d9337f5ed557a4a1"
        }
      ],
      "title": "Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54210",
    "datePublished": "2025-12-30T12:11:08.682Z",
    "dateReserved": "2025-12-30T12:06:44.500Z",
    "dateUpdated": "2026-08-05T09:18:04.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54210",
      "date": "2026-09-22",
      "epss": "0.00144",
      "percentile": "0.04031"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0d4d6b083da9b033ddccef72d77f373c819ae3ea",
                    "status": "affected",
                    "version": "7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf00c2c8f6254f44ac041aa9a311ae9e0caf692b",
                    "status": "affected",
                    "version": "7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de6dfcefd107667ce2dbedf4d9337f5ed557a4a1",
                    "status": "affected",
                    "version": "7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/hci_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.4.*",
                    "status": "unaffected",
                    "version": "6.4.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.5",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()\n\nKASAN reports that there\u0027s a use-after-free in\nhci_remove_adv_monitor(). Trawling through the disassembly, you can\nsee that the complaint is from the access in bt_dev_dbg() under the\nHCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because\nmsft_remove_monitor() can end up freeing the monitor\nstructure. Specifically:\n  hci_remove_adv_monitor() -\u003e\n  msft_remove_monitor() -\u003e\n  msft_remove_monitor_sync() -\u003e\n  msft_le_cancel_monitor_advertisement_cb() -\u003e\n  hci_free_adv_monitor()\n\nLet\u0027s fix the problem by just stashing the relevant data when it\u0027s\nstill valid."
          }
        ],
        "id": "CVE-2023-54210",
        "lastModified": "2026-08-04T11:16:36.870",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:09.197",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0d4d6b083da9b033ddccef72d77f373c819ae3ea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf00c2c8f6254f44ac041aa9a311ae9e0caf692b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de6dfcefd107667ce2dbedf4d9337f5ed557a4a1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:53:01+00:00",
      "cve": "CVE-2023-54210",
      "id": "CVE-2023-54210",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "122",
      "product_status:known_not_affected": "152",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54210.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.