Executive brief
The Linux kernel's Bluetooth subsystem contains a use-after-free vulnerability in the advertisement monitor setup function. When adding a Bluetooth advertisement monitor, the code attempts to read a freed memory object during debug logging, which could allow local attackers to trigger a kernel crash or potentially execute arbitrary code.
Technical details
A use-after-free vulnerability exists in the Bluetooth HCI (Host Controller Interface) synchronization code, specifically in the hci_add_adv_monitor() function in net/bluetooth/hci_core.c. The vulnerability occurs when an error occurs during the MSFT (Microsoft) advertisement monitor pattern addition: the error path frees the monitor object via hci_free_adv_monitor(), but the debug logging statement in hci_add_adv_monitor() still attempts to reference the freed monitor->handle field. An attacker with local access and the ability to trigger advertisement monitor setup can cause a kernel memory safety violation. The fix involves using the locally-stored handle variable instead of dereferencing the freed monitor structure. Patches are available in Linux kernel stable trees.
Affected products
- Linux Linux kernel multiple versions (see stable tree branches linux-5.x, linux-6.x, etc.)
Timeline
- 2023-08-04: disclosed: Upstream commit by Manish Mandlik
- 2023-09-13: patched: Backported to Linux stable trees