Vulnerability-Lookup

FKIE_CVE-2023-53828

Vulnerability from fkie_nvd - Published: 2025-12-09 16:17 - Updated: 2026-08-04 10:19

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() KSAN reports use-after-free in hci_add_adv_monitor(). While adding an adv monitor, hci_add_adv_monitor() calls -> msft_add_monitor_pattern() calls -> msft_add_monitor_sync() calls -> msft_le_monitor_advertisement_cb() calls in an error case -> hci_free_adv_monitor() which frees the *moniter. This is referenced by bt_dev_dbg() in hci_add_adv_monitor(). Fix the bt_dev_dbg() by using handle instead of monitor->handle.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81d8e9f59df63b8358751c1ffed9f1cf5c796909",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "aafda69d4807f5edf3558c9534be9b911774e63a",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "8d66f7ced51cb924bc90278d6a0a26a52877271a",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "a2bcd2b63271a93a695fabbfbf459c603d956d48",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n    hci_add_adv_monitor() calls -\u003e\n    msft_add_monitor_pattern() calls -\u003e\n    msft_add_monitor_sync() calls -\u003e\n    msft_le_monitor_advertisement_cb() calls in an error case -\u003e\n    hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor-\u003ehandle."
    }
  ],
  "id": "CVE-2023-53828",
  "lastModified": "2026-08-04T10:19:23.317",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-09T16:17:21.680",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}

CVE-2023-53828 (GCVE-0-2023-53828)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-08-05 09:16

Title

Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/81d8e9f59df63b835…
https://git.kernel.org/stable/c/aafda69d4807f5edf…
https://git.kernel.org/stable/c/8d66f7ced51cb924b…
https://git.kernel.org/stable/c/a2bcd2b63271a93a6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b747a83690c8f53bc7a3f75899415c699b2c51aa , < 81d8e9f59df63b8358751c1ffed9f1cf5c796909 (git) Affected: b747a83690c8f53bc7a3f75899415c699b2c51aa , < aafda69d4807f5edf3558c9534be9b911774e63a (git) Affected: b747a83690c8f53bc7a3f75899415c699b2c51aa , < 8d66f7ced51cb924bc90278d6a0a26a52877271a (git) Affected: b747a83690c8f53bc7a3f75899415c699b2c51aa , < a2bcd2b63271a93a695fabbfbf459c603d956d48 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.53 , ≤ 6.1.* (semver) Unaffected: 6.4.16 , ≤ 6.4.* (semver) Unaffected: 6.5.3 , ≤ 6.5.* (semver) Unaffected: 6.6 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81d8e9f59df63b8358751c1ffed9f1cf5c796909",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "aafda69d4807f5edf3558c9534be9b911774e63a",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "8d66f7ced51cb924bc90278d6a0a26a52877271a",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            },
            {
              "lessThan": "a2bcd2b63271a93a695fabbfbf459c603d956d48",
              "status": "affected",
              "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n    hci_add_adv_monitor() calls -\u003e\n    msft_add_monitor_pattern() calls -\u003e\n    msft_add_monitor_sync() calls -\u003e\n    msft_le_monitor_advertisement_cb() calls in an error case -\u003e\n    hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor-\u003ehandle."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through a local `AF_BLUETOOTH`/`BTPROTO_HCI` management socket issuing `MGMT_OP_ADD_ADV_PATTERNS_MONITOR{,_RSSI}`; the freeing condition is the local controller\u0027s HCI command-complete status, which no remote or adjacent Bluetooth peer can drive.\nAC:L - The attacker deterministically produces the error status by submitting monitors the controller rejects (exceeding its MSFT monitor capacity or invalid RSSI thresholds), or by emulating the controller via vhci, so no condition outside their control is required.\nPR:L - The mgmt control channel requires a trusted socket (`CAP_NET_ADMIN` at bind), which in real deployments is held by an unprivileged system Bluetooth daemon (`bluetoothd` user, Android bluetooth uid) rather than full root, matching the PR:L scoring used for the identical mgmt adv-monitor UAF path.\nUI:N - The attacker triggers the whole sequence by sending management commands on its own socket; no action by any other user or victim is needed.\nS:U - The freed object and the dereference both live in kernel heap within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `struct adv_monitor` is read after free from a sprayable kmalloc-64 slab, and the same freed handle field is propagated out to userspace in the mgmt command-complete reply, disclosing reclaimed kernel heap contents.\nI:H - The use-after-free leaves an attacker-reclaimable freed object referenced by the kernel, and heap grooming of that slab can be leveraged into corruption of adjacent/reclaimed state and control-flow influence.\nA:H - Dereferencing freed slab memory reliably oopses under KASAN or hardened allocators and can panic the kernel when the backing page has been returned, and the condition is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:17.964Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"
        },
        {
          "url": "https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"
        }
      ],
      "title": "Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53828",
    "datePublished": "2025-12-09T01:29:42.166Z",
    "dateReserved": "2025-12-09T01:27:17.825Z",
    "dateUpdated": "2026-08-05T09:16:17.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.