CVE-2023-53828

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53828", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-09T01:27:17.825Z", "datePublished": "2025-12-09T01:29:42.166Z", "dateUpdated": "2026-10-15T21:41:37.140Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:17.964Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n hci_add_adv_monitor() calls ->\n msft_add_monitor_pattern() calls ->\n msft_add_monitor_sync() calls ->\n msft_le_monitor_advertisement_cb() calls in an error case ->\n hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor->handle."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through a local `AF_BLUETOOTH`/`BTPROTO_HCI` management socket issuing `MGMT_OP_ADD_ADV_PATTERNS_MONITOR{,_RSSI}`; the freeing condition is the local controller's HCI command-complete status, which no remote or adjacent Bluetooth peer can drive.\nAC:L - The attacker deterministically produces the error status by submitting monitors the controller rejects (exceeding its MSFT monitor capacity or invalid RSSI thresholds), or by emulating the controller via vhci, so no condition outside their control is required.\nPR:L - The mgmt control channel requires a trusted socket (`CAP_NET_ADMIN` at bind), which in real deployments is held by an unprivileged system Bluetooth daemon (`bluetoothd` user, Android bluetooth uid) rather than full root, matching the PR:L scoring used for the identical mgmt adv-monitor UAF path.\nUI:N - The attacker triggers the whole sequence by sending management commands on its own socket; no action by any other user or victim is needed.\nS:U - The freed object and the dereference both live in kernel heap within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `struct adv_monitor` is read after free from a sprayable kmalloc-64 slab, and the same freed handle field is propagated out to userspace in the mgmt command-complete reply, disclosing reclaimed kernel heap contents.\nI:H - The use-after-free leaves an attacker-reclaimable freed object referenced by the kernel, and heap grooming of that slab can be leveraged into corruption of adjacent/reclaimed state and control-flow influence.\nA:H - Dereferencing freed slab memory reliably oopses under KASAN or hardened allocators and can panic the kernel when the backing page has been returned, and the condition is repeatable at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_core.c"], "versions": [{"version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "81d8e9f59df63b8358751c1ffed9f1cf5c796909", "status": "affected", "versionType": "git"}, {"version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "aafda69d4807f5edf3558c9534be9b911774e63a", "status": "affected", "versionType": "git"}, {"version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "8d66f7ced51cb924bc90278d6a0a26a52877271a", "status": "affected", "versionType": "git"}, {"version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "a2bcd2b63271a93a695fabbfbf459c603d956d48", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_core.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.53", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.4.16", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.3", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.4.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.5.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"}, {"url": "https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"}, {"url": "https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"}, {"url": "https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"}], "title": "Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:37:35.211467Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:37.140Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:37:35.211467Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:37:35.979Z"}}], "cna": {"title": "Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through a local `AF_BLUETOOTH`/`BTPROTO_HCI` management socket issuing `MGMT_OP_ADD_ADV_PATTERNS_MONITOR{,_RSSI}`; the freeing condition is the local controller's HCI command-complete status, which no remote or adjacent Bluetooth peer can drive.\nAC:L - The attacker deterministically produces the error status by submitting monitors the controller rejects (exceeding its MSFT monitor capacity or invalid RSSI thresholds), or by emulating the controller via vhci, so no condition outside their control is required.\nPR:L - The mgmt control channel requires a trusted socket (`CAP_NET_ADMIN` at bind), which in real deployments is held by an unprivileged system Bluetooth daemon (`bluetoothd` user, Android bluetooth uid) rather than full root, matching the PR:L scoring used for the identical mgmt adv-monitor UAF path.\nUI:N - The attacker triggers the whole sequence by sending management commands on its own socket; no action by any other user or victim is needed.\nS:U - The freed object and the dereference both live in kernel heap within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `struct adv_monitor` is read after free from a sprayable kmalloc-64 slab, and the same freed handle field is propagated out to userspace in the mgmt command-complete reply, disclosing reclaimed kernel heap contents.\nI:H - The use-after-free leaves an attacker-reclaimable freed object referenced by the kernel, and heap grooming of that slab can be leveraged into corruption of adjacent/reclaimed state and control-flow influence.\nA:H - Dereferencing freed slab memory reliably oopses under KASAN or hardened allocators and can panic the kernel when the backing page has been returned, and the condition is repeatable at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "81d8e9f59df63b8358751c1ffed9f1cf5c796909", "versionType": "git"}, {"status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "aafda69d4807f5edf3558c9534be9b911774e63a", "versionType": "git"}, {"status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "8d66f7ced51cb924bc90278d6a0a26a52877271a", "versionType": "git"}, {"status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "lessThan": "a2bcd2b63271a93a695fabbfbf459c603d956d48", "versionType": "git"}], "programFiles": ["net/bluetooth/hci_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.53", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.4.16", "versionType": "semver", "lessThanOrEqual": "6.4.*"}, {"status": "unaffected", "version": "6.5.3", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/hci_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"}, {"url": "https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"}, {"url": "https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"}, {"url": "https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n hci_add_adv_monitor() calls ->\n msft_add_monitor_pattern() calls ->\n msft_add_monitor_sync() calls ->\n msft_le_monitor_advertisement_cb() calls in an error case ->\n hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor->handle."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.53", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4.16", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5.3", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:17.964Z"}}}, "cveMetadata": {"cveId": "CVE-2023-53828", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:37.140Z", "dateReserved": "2025-12-09T01:27:17.825Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-09T01:29:42.166Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/hci_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "81d8e9f59df63b8358751c1ffed9f1cf5c796909", "status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "versionType": "git"}, {"lessThan": "aafda69d4807f5edf3558c9534be9b911774e63a", "status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "versionType": "git"}, {"lessThan": "8d66f7ced51cb924bc90278d6a0a26a52877271a", "status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "versionType": "git"}, {"lessThan": "a2bcd2b63271a93a695fabbfbf459c603d956d48", "status": "affected", "version": "b747a83690c8f53bc7a3f75899415c699b2c51aa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/hci_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.53", "versionType": "semver"}, {"lessThanOrEqual": "6.4.*", "status": "unaffected", "version": "6.4.16", "versionType": "semver"}, {"lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\n\nKSAN reports use-after-free in hci_add_adv_monitor().\n\nWhile adding an adv monitor,\n hci_add_adv_monitor() calls ->\n msft_add_monitor_pattern() calls ->\n msft_add_monitor_sync() calls ->\n msft_le_monitor_advertisement_cb() calls in an error case ->\n hci_free_adv_monitor() which frees the *moniter.\n\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\n\nFix the bt_dev_dbg() by using handle instead of monitor->handle."}], "id": "CVE-2023-53828", "lastModified": "2026-10-15T22:17:49.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-53828", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:37:35.211467Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:21.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81d8e9f59df63b8358751c1ffed9f1cf5c796909"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d66f7ced51cb924bc90278d6a0a26a52877271a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a2bcd2b63271a93a695fabbfbf459c603d956d48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aafda69d4807f5edf3558c9534be9b911774e63a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()", "id": "2420315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420315"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()\nKSAN reports use-after-free in hci_add_adv_monitor().\nWhile adding an adv monitor,\nhci_add_adv_monitor() calls ->\nmsft_add_monitor_pattern() calls ->\nmsft_add_monitor_sync() calls ->\nmsft_le_monitor_advertisement_cb() calls in an error case ->\nhci_free_adv_monitor() which frees the *moniter.\nThis is referenced by bt_dev_dbg() in hci_add_adv_monitor().\nFix the bt_dev_dbg() by using handle instead of monitor->handle."], "name": "CVE-2023-53828", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53828\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53828\nhttps://lore.kernel.org/linux-cve-announce/2025120952-CVE-2023-53828-57cf@gregkh/T"], "threat_severity": "Important"}

{}