CVE-2023-28464

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

Weakness

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Affected Software

Potential Mitigations

References

• https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/
• https://security.netapp.com/advisory/ntap-20230517-0004/
• https://www.openwall.com/lists/oss-security/2023/03/28/2
• https://www.openwall.com/lists/oss-security/2023/03/28/3