Executive brief
The Linux kernel's Bluetooth L2CAP protocol implementation contains a use-after-free vulnerability in the disconnect request and response handlers. An attacker on an adjacent network can trigger this flaw by sending specially crafted Bluetooth packets, potentially causing a kernel crash or enabling arbitrary code execution. This affects systems with Bluetooth connectivity enabled.
Technical details
The vulnerability is a use-after-free (CWE-416) in the `l2cap_disconnect_req()` and `l2cap_disconnect_rsp()` functions within `net/bluetooth/l2cap_core.c`. The root cause is improper reference counting of L2CAP channel objects during disconnection. An attacker can send a disconnect request or response packet to a system with Bluetooth enabled, causing the kernel to reference a channel object that has already been freed, leading to potential information disclosure or code execution. The fix uses `l2cap_chan_hold_unless_zero()` to safely hold a reference before accessing the channel and properly manage the mutex locking order to prevent race conditions. No user authentication is required; the attack is triggered via adjacent network access to Bluetooth.
Affected products
- Linux Linux kernel multiple versions (fix available from 2023-04-06)
Timeline
- 2023-04-06: disclosed: Patch committed upstream
- 2023-12-09: advisory: CVE-2023-53827 published