CVE-2023-53145

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53145
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/179c65828593aff1f444e15debd40a477cb23cf4 Patch
https://git.kernel.org/stable/c/3efcbf25e5ab4d4ad1b7e6ba0869ff85540e3f6e Patch
https://git.kernel.org/stable/c/6c3653627397a0d6eab19b20a59423e118985a6b Patch
https://git.kernel.org/stable/c/73f7b171b7c09139eb3c6a5677c200dc1be5f318 Patch
https://git.kernel.org/stable/c/746b363bef41cc159c051c47f9e30800bc6b520d Patch
https://git.kernel.org/stable/c/a5c2a467e9e789ae0891de55b766daac52e3b7b3 Patch
https://git.kernel.org/stable/c/a6650d27ab2c12a8ee750f396edb5ac8b4558b2e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc6:*:*:*:*:*:*
History

12 Nov 2025, 20:42

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.3:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc6:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/179c65828593aff1f444e15debd40a477cb23cf4 - () https://git.kernel.org/stable/c/179c65828593aff1f444e15debd40a477cb23cf4 - Patch
References () https://git.kernel.org/stable/c/3efcbf25e5ab4d4ad1b7e6ba0869ff85540e3f6e - () https://git.kernel.org/stable/c/3efcbf25e5ab4d4ad1b7e6ba0869ff85540e3f6e - Patch
References () https://git.kernel.org/stable/c/6c3653627397a0d6eab19b20a59423e118985a6b - () https://git.kernel.org/stable/c/6c3653627397a0d6eab19b20a59423e118985a6b - Patch
References () https://git.kernel.org/stable/c/73f7b171b7c09139eb3c6a5677c200dc1be5f318 - () https://git.kernel.org/stable/c/73f7b171b7c09139eb3c6a5677c200dc1be5f318 - Patch
References () https://git.kernel.org/stable/c/746b363bef41cc159c051c47f9e30800bc6b520d - () https://git.kernel.org/stable/c/746b363bef41cc159c051c47f9e30800bc6b520d - Patch
References () https://git.kernel.org/stable/c/a5c2a467e9e789ae0891de55b766daac52e3b7b3 - () https://git.kernel.org/stable/c/a5c2a467e9e789ae0891de55b766daac52e3b7b3 - Patch
References () https://git.kernel.org/stable/c/a6650d27ab2c12a8ee750f396edb5ac8b4558b2e - () https://git.kernel.org/stable/c/a6650d27ab2c12a8ee750f396edb5ac8b4558b2e - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416
First Time Linux
Linux linux Kernel

12 May 2025, 17:32

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btsdio: se corrige el error de use after free en btsdio_remove debido a una condición de ejecución. En btsdio_probe, el trabajo data->work está enlazado con btsdio_work. Se iniciará en btsdio_send_frame. Si btsdio_remove se ejecuta con un trabajo sin terminar, puede existir una condición de carrera que indique que hdev se libera, pero se usa en btsdio_work. Para solucionarlo, cancele el trabajo antes de realizar la limpieza en btsdio_remove.

10 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-10 15:15

Updated : 2025-11-12 20:42

NVD link : CVE-2023-53145

Mitre link : CVE-2023-53145

CVE.ORG link : CVE-2023-53145

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free