CVE-2023-54210

Vulnerability

CVE-2023-54210 describes a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_remove_adv_monitor() function. KASAN reports the issue originates from a debug statement (bt_dev_dbg()) that accesses the monitor structure after it has been freed by msft_remove_monitor(). The problematic call chain is: hci_remove_adv_monitor() -> msft_remove_monitor() -> msft_remove_monitor_sync() -> msft_le_cancel_monitor_advertisement_cb() -> hci_free_adv_monitor(). The pointer becomes dangling before the debug print completes.

Exploitation

No special privileges beyond local access are required to trigger the path, as the Bluetooth subsystem is reachable from user space via HCI sockets. An attacker could craft a sequence of monitor removal operations that causes the kernel to read freed memory, leading to a crash or potentially arbitrary code execution. The issue is exploitable when the Bluetooth hardware supports the Microsoft vendor extension (HCI_ADV_MONITOR_EXT_MSFT).

Impact

Successful exploitation could lead to a denial of service (system crash) or, in more severe cases, privilege escalation or information disclosure due to corrupted kernel memory. The CVSS score and severity were not provided, but use-after-free bugs in the kernel are generally rated high to critical.

Mitigation

The fix is to stash the relevant data before calling functions that may free the monitor. Both stable kernel commits [1] and [2] address this by reading the debug data earlier. Users should apply the latest stable kernel updates to resolve the vulnerability.