CVE-2023-28464

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/	Mailing List Patch
https://security.netapp.com/advisory/ntap-20230517-0004/	Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/03/28/2	Mailing List Patch
https://www.openwall.com/lists/oss-security/2023/03/28/3	Mailing List

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel:6.1.25:::::::*
	cpe:2.3:o:linux:linux_kernel:6.2.12:::::::*
	cpe:2.3:o:linux:linux_kernel:6.3:-::::::
	cpe:2.3:o:linux:linux_kernel:6.3:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.3:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.3:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.3:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.3:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.3:rc6::::::

Configuration 2 (hide)

OR	cpe:2.3:o:netapp:h300s_firmware:-:::::::*
	cpe:2.3:o:netapp:h410c_firmware:-:::::::*
	cpe:2.3:o:netapp:h410s_firmware:-:::::::*
	cpe:2.3:o:netapp:h500s_firmware:-:::::::*
	cpe:2.3:o:netapp:h700s_firmware:-:::::::*

History

No history.

Information

Published : 2023-03-31 16:15

Updated : 2023-12-22 21:04

NVD link : CVE-2023-28464

Mitre link : CVE-2023-28464

CVE.ORG link : CVE-2023-28464

JSON object : View

Products Affected

netapp

h300s_firmware
h410c_firmware
h410s_firmware
h500s_firmware
h700s_firmware

linux

linux_kernel

CWE

CWE-415

Double Free

{"id": "CVE-2023-28464", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-03-31T16:15:07.557", "references": [{"url": "https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/", "tags": ["Mailing List", "Patch"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20230517-0004/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2023/03/28/2", "tags": ["Mailing List", "Patch"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2023/03/28/3", "tags": ["Mailing List"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation."}], "lastModified": "2023-12-22T21:04:49.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBF27CF3-0CF3-49C5-B2FB-122DE725DFD0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72352E44-DFB4-4C71-81F3-55924B2B7CF3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21D6F467-B848-453E-B1A4-BEF940E413A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A47F0FC3-CE52-4BA1-BA51-22F783938431"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3583026A-27EC-4A4C-850A-83F2AF970673"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC271202-7570-4505-89A4-D602D47BFD00"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D413BB6D-4F74-4C7D-9163-47786619EF53"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4D613FB-9976-4989-8C4A-567773373CEA"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6770B6C3-732E-4E22-BF1C-2D2FD610061C"}, {"criteria": "cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31"}, {"criteria": "cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0B4AD8A-F172-4558-AEC6-FF424BA2D912"}, {"criteria": "cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FFF7106-ED78-49BA-9EC5-B889E3685D53"}, {"criteria": "cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56409CEC-5A1E-4450-AA42-641E459CC2AF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}