{"id":"CVE-2023-1989","state":"PUBLISHED","title":"Kernel: use after free bug in btsdio_remove due to race condition","description":"A use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.","publishedAt":"2023-04-11T00:00:00.000Z","updatedAt":"2026-10-01T10:58:00.904Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["linux","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"packageName":"linux","defaultStatus":"unaffected","versions":[{"version":"2.6.24","status":"affected","lessThan":"4.14.326","versionType":"semver"},{"version":"4.15","status":"affected","lessThan":"4.19.295","versionType":"semver"},{"version":"4.20","status":"affected","lessThan":"5.4.257","versionType":"semver"},{"version":"5.5","status":"affected","lessThan":"5.10.195","versionType":"semver"},{"version":"5.11","status":"affected","lessThan":"5.15.131","versionType":"semver"},{"version":"5.16","status":"affected","lessThan":"6.1.52","versionType":"semver"},{"version":"6.2","status":"affected","lessThan":"6.3","versionType":"semver"}],"collectionURL":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel-rt","defaultStatus":"affected","versions":[{"version":"0:4.18.0-513.5.1.rt7.307.el8_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv","cpe:/a:redhat:enterprise_linux:8::realtime"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-513.5.1.el8_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-372.91.1.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.6::crb","cpe:/o:redhat:rhel_eus:8.6::baseos","cpe:/o:redhat:rhev_hypervisor:4.4::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-477.64.1.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::crb","cpe:/o:redhat:rhel_eus:8.8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-362.8.1.el9_3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::nfv","cpe:/a:redhat:enterprise_linux:9::realtime","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-362.8.1.el9_3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::nfv","cpe:/a:redhat:enterprise_linux:9::realtime","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Virtualization 4 for Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-372.91.1.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.6::crb","cpe:/o:redhat:rhel_eus:8.6::baseos","cpe:/o:redhat:rhev_hypervisor:4.4::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"kernel","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel-rt","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel-rt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":["https://access.redhat.com/errata/RHSA-2023:6583","https://access.redhat.com/errata/RHSA-2023:6901","https://access.redhat.com/errata/RHSA-2023:7077","https://access.redhat.com/errata/RHSA-2024:0724","https://access.redhat.com/errata/RHSA-2024:4740","https://access.redhat.com/security/cve/CVE-2023-1989","https://bugzilla.redhat.com/show_bug.cgi?id=2185945","https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088","https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html","https://security.netapp.com/advisory/ntap-20230601-0004/","https://www.debian.org/security/2023/dsa-5492","https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/1xxx/CVE-2023-1989.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-1989","state":"PUBLISHED","datePublished":"2023-04-11T00:00:00.000Z","dateUpdated":"2026-10-01T10:58:00.904Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-04-11T00:00:00.000Z"},"containers":{"cna":{"title":"Kernel: use after free bug in btsdio_remove due to race condition","descriptions":[{"lang":"en","value":"A use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices."}],"affected":[{"packageName":"linux","defaultStatus":"unaffected","versions":[{"version":"2.6.24","status":"affected","lessThan":"4.14.326","versionType":"semver"},{"version":"4.15","status":"affected","lessThan":"4.19.295","versionType":"semver"},{"version":"4.20","status":"affected","lessThan":"5.4.257","versionType":"semver"},{"version":"5.5","status":"affected","lessThan":"5.10.195","versionType":"semver"},{"version":"5.11","status":"affected","lessThan":"5.15.131","versionType":"semver"},{"version":"5.16","status":"affected","lessThan":"6.1.52","versionType":"semver"},{"version":"6.2","status":"affected","lessThan":"6.3","versionType":"semver"}],"collectionURL":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel-rt","defaultStatus":"affected","versions":[{"version":"0:4.18.0-513.5.1.rt7.307.el8_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv","cpe:/a:redhat:enterprise_linux:8::realtime"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-513.5.1.el8_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-372.91.1.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.6::crb","cpe:/o:redhat:rhel_eus:8.6::baseos","cpe:/o:redhat:rhev_hypervisor:4.4::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-477.64.1.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::crb","cpe:/o:redhat:rhel_eus:8.8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-362.8.1.el9_3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::nfv","cpe:/a:redhat:enterprise_linux:9::realtime","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:5.14.0-362.8.1.el9_3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::nfv","cpe:/a:redhat:enterprise_linux:9::realtime","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Virtualization 4 for Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"affected","versions":[{"version":"0:4.18.0-372.91.1.el8_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.6::crb","cpe:/o:redhat:rhel_eus:8.6::baseos","cpe:/o:redhat:rhev_hypervisor:4.4::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"kernel","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel-rt","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel-rt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6583","name":"RHSA-2023:6583","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6901","name":"RHSA-2023:6901","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7077","name":"RHSA-2023:7077","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0724","name":"RHSA-2024:0724","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4740","name":"RHSA-2024:4740","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1989","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185945","name":"RHBZ#2185945","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-01T10:58:00.904Z"},"datePublic":"2023-03-09T06:30:00.000Z","x_redhatCweChain":"CWE-416: Use After Free","workarounds":[{"lang":"en","value":"This flaw can be mitigated by preventing the affected Generic Bluetooth SDIO driver kernel module from loading during the boot time. Ensure the module is added into the blacklist file.\n~~~\nRefer:  \nHow do I blacklist a kernel module to prevent it from loading automatically? \nhttps://access.redhat.com/solutions/41278\n~~~"}],"timeline":[{"lang":"en","time":"2023-04-11T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-03-09T06:30:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html","name":"[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html","name":"[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update","tags":["mailing-list","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20230601-0004/","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2023/dsa-5492","name":"DSA-5492","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html","name":"[debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update","tags":["mailing-list","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:05:27.122Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"netapp","product":"hci_baseboard_management_controller","defaultStatus":"unknown","versions":[{"version":"h300s","status":"affected"},{"version":"h410c","status":"affected"},{"version":"h410s","status":"affected"},{"version":"h500s","status":"affected"},{"version":"h700s","status":"affected"}],"cpes":["cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"6.3+rc4","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"]},{"vendor":"debian","product":"debian_linux","defaultStatus":"unknown","versions":[{"version":"5.10.178-3","status":"affected"}],"cpes":["cpe:2.3:o:debian:debian_linux:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-05-10T04:00:19.103887Z","id":"CVE-2023-1989","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-26T13:09:35.058Z"}}]}}}