{"id":"CVE-2023-7356","state":"PUBLISHED","title":"Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID.","publishedAt":"2026-10-21T14:59:38.724Z","updatedAt":"2026-10-26T06:55:41.493Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e4cfffb5ebc80820f46cf16a6fa5be1b436bdf2d","status":"affected","lessThan":"ba25efe15e8fd909884e113a86c6ccd07d88256e","versionType":"git"},{"version":"9c0826310bfb784c9bac7d1d9454e304185446c5","status":"affected","lessThan":"927ef409f713929dea2b9a5ed5bb65e712be0050","versionType":"git"},{"version":"9c0826310bfb784c9bac7d1d9454e304185446c5","status":"affected","lessThan":"f4da3ee15de9944482382181329bb6d7335ca003","versionType":"git"},{"version":"6.1.159","status":"affected","lessThan":"6.1.178","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]}],"references":["https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e","https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050","https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/7xxx/CVE-2023-7356.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-7356","state":"PUBLISHED","datePublished":"2026-10-21T14:59:38.724Z","dateUpdated":"2026-10-26T06:55:41.493Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-10-21T14:57:20.443Z"},"containers":{"cna":{"title":"Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID\n\nCopy the content of a Periodic Advertisement Report to BASE only if\nthe service UUID is Basic Audio Announcement Service UUID."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e4cfffb5ebc80820f46cf16a6fa5be1b436bdf2d","status":"affected","lessThan":"ba25efe15e8fd909884e113a86c6ccd07d88256e","versionType":"git"},{"version":"9c0826310bfb784c9bac7d1d9454e304185446c5","status":"affected","lessThan":"927ef409f713929dea2b9a5ed5bb65e712be0050","versionType":"git"},{"version":"9c0826310bfb784c9bac7d1d9454e304185446c5","status":"affected","lessThan":"f4da3ee15de9944482382181329bb6d7335ca003","versionType":"git"},{"version":"6.1.159","status":"affected","lessThan":"6.1.178","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/iso.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ba25efe15e8fd909884e113a86c6ccd07d88256e"},{"url":"https://git.kernel.org/stable/c/927ef409f713929dea2b9a5ed5bb65e712be0050"},{"url":"https://git.kernel.org/stable/c/f4da3ee15de9944482382181329bb6d7335ca003"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - A BLE Periodic Advertising Report supplies ev3->length and ev3->data through hci_recv_frame()→hci_event_packet()→hci_le_per_adv_report_evt()→hci_proto_connect_ind()→iso_connect_ind(); exploitation therefore requires Bluetooth radio proximity.\nAC:L - A single matched report with length 251–255 overwrites padding and up to five low bytes of iso_pinfo.conn; iso_connect_ind() performs the memcpy deterministically, with no race or condition outside the broadcaster's control.\nPR:N - hci_le_per_adv_report_evt() performs no pairing, authentication, or authorization check before calling iso_connect_ind(); iso_match_sync_handle_pa_report() only matches the unauthenticated report to an existing periodic-advertising sync.\nUI:N - Once an ISO broadcast-sink listener is synchronized, receipt of the crafted periodic report invokes iso_connect_ind() automatically; no victim action is required for the overflowing report.\nS:U - The overwrite corrupts iso_pinfo and its iso_conn pointer within the same host kernel security authority; it does not cross a VM, IOMMU, or other security boundary.\nC:H - base[248] immediately precedes the live conn pointer, and the overflow can redirect later conn->hcon reads in iso_sock_get_qos() and related paths, providing exploitable kernel-pointer corruption capable of arbitrary memory disclosure.\nI:H - The unchecked memcpy() writes beyond iso_pinfo.base into low bytes of iso_pinfo.conn; subsequent writes and lock operations through that corrupted pointer in iso_chan_del() and timer helpers can enable arbitrary kernel-memory corruption or control-flow hijacking.\nA:H - A corrupted iso_pinfo.conn is dereferenced by iso_sock_clear_timer(), iso_sock_get_qos(), send, and close paths, allowing an unauthenticated broadcaster to trigger a kernel oops or panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-26T06:55:41.493Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.159","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}