Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2023-1989

Kernel: use after free bug in btsdio_remove due to race condition

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

linux

Default version status: unaffected

  • 2.6.24 to < 4.14.326affected
  • 4.15 to < 4.19.295affected
  • 4.20 to < 5.4.257affected
  • 5.5 to < 5.10.195affected
  • 5.11 to < 5.15.131affected
  • 5.16 to < 6.1.52affected
  • 6.2 to < 6.3affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.18.0-513.5.1.rt7.307.el8_9 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.18.0-513.5.1.el8_9 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support

Default version status: affected

  • 0:4.18.0-372.91.1.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

Default version status: affected

  • 0:4.18.0-477.64.1.el8_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:5.14.0-362.8.1.el9_3 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:5.14.0-362.8.1.el9_3 to < *unaffected

Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.18.0-372.91.1.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

References