In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
In btsdioprobe, the data->work is bound with btsdiowork. It will be started in btsdiosendframe.
If the btsdioremove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdiowork. Fix it by canceling the work before do cleanup in btsdio_remove.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c2a467e9e789ae0891de55b766daac52e3b7b3",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-53145-0ad9df47",
"signature_version": "v1",
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
},
"target": {
"file": "drivers/bluetooth/btsdio.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7b171b7c09139eb3c6a5677c200dc1be5f318",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-53145-0e481992",
"signature_version": "v1",
"digest": {
"line_hashes": [
"170143361810945339656031389852500433063",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
},
"target": {
"file": "drivers/bluetooth/btsdio.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7b171b7c09139eb3c6a5677c200dc1be5f318",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-53145-14a785ab",
"signature_version": "v1",
"digest": {
"length": 261.0,
"function_hash": "286875961747049385681922624464955100069"
},
"target": {
"function": "btsdio_remove",
"file": "drivers/bluetooth/btsdio.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c2a467e9e789ae0891de55b766daac52e3b7b3",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-53145-4f40d8df",
"signature_version": "v1",
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
},
"target": {
"function": "btsdio_remove",
"file": "drivers/bluetooth/btsdio.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@746b363bef41cc159c051c47f9e30800bc6b520d",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2023-53145-6413fbcf",
"signature_version": "v1",
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
},
"target": {
"file": "drivers/bluetooth/btsdio.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@746b363bef41cc159c051c47f9e30800bc6b520d",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2023-53145-6fc98056",
"signature_version": "v1",
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
},
"target": {
"function": "btsdio_remove",
"file": "drivers/bluetooth/btsdio.c"
}
}
]