CVE-2023-54120

Vulnerability

CVE-2023-54120 is a race condition vulnerability in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) implementation. The issue is a race condition in the hidp_session_thread function. Specifically, the timer used for idle timeout handling remains active while hidp_del_timer is called. If hidp_session_put is invoked before the timer is safely removed, the session structure can be freed while the timer callback (`hidp_idle_timeout is still running, leading to a use-after-free condition [1][2][3].

Exploitation

To exploit this vulnerability, an attacker would need to trigger the race condition between the timer expiration and session cleanup in a specific order. This requires local access to the system and the ability to interact with Bluetooth HIDP devices. The attack surface is limited to systems where Bluetooth HIDP is enabled and in use. No authentication is needed beyond local user access to trigger the relevant code paths [1][2][3].

Impact

Successful exploitation results in a kernel panic, causing a denial of service (DoS). The use-after-free can corrupt kernel memory, potentially leading to system crash or instability. There is no indication of privilege escalation or remote code execution from the available sources [1][2][3].

Mitigation

The fix replaces del_timer with del_timer_sync in the hidp_session_thread function, ensuring the timer is fully deactivated before the session is freed. This patch has been applied to the stable kernel branches as referenced in the commit history [1][2][3]. Users should update their Linux kernel to a version containing this fix.