In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
In btsdioprobe, the data->work is bound with btsdiowork. It will be started in btsdiosendframe.
If the btsdioremove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdiowork. Fix it by canceling the work before do cleanup in btsdio_remove.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53145.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53145.json"
[
{
"id": "CVE-2023-53145-0ad9df47",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c2a467e9e789ae0891de55b766daac52e3b7b3",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
},
{
"id": "CVE-2023-53145-0c0f27ef",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6650d27ab2c12a8ee750f396edb5ac8b4558b2e",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
},
{
"id": "CVE-2023-53145-0e481992",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7b171b7c09139eb3c6a5677c200dc1be5f318",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"170143361810945339656031389852500433063",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
},
{
"id": "CVE-2023-53145-14a785ab",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7b171b7c09139eb3c6a5677c200dc1be5f318",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 261.0,
"function_hash": "286875961747049385681922624464955100069"
}
},
{
"id": "CVE-2023-53145-15b31a68",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c3653627397a0d6eab19b20a59423e118985a6b",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
},
{
"id": "CVE-2023-53145-4f40d8df",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c2a467e9e789ae0891de55b766daac52e3b7b3",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
}
},
{
"id": "CVE-2023-53145-6413fbcf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@746b363bef41cc159c051c47f9e30800bc6b520d",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
},
{
"id": "CVE-2023-53145-6fc98056",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@746b363bef41cc159c051c47f9e30800bc6b520d",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
}
},
{
"id": "CVE-2023-53145-941fc83c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efcbf25e5ab4d4ad1b7e6ba0869ff85540e3f6e",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
}
},
{
"id": "CVE-2023-53145-aa66cd0b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c3653627397a0d6eab19b20a59423e118985a6b",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
}
},
{
"id": "CVE-2023-53145-afdbd11c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@179c65828593aff1f444e15debd40a477cb23cf4",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
}
},
{
"id": "CVE-2023-53145-b7b23f56",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@179c65828593aff1f444e15debd40a477cb23cf4",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
},
{
"id": "CVE-2023-53145-b92ddcb3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6650d27ab2c12a8ee750f396edb5ac8b4558b2e",
"target": {
"file": "drivers/bluetooth/btsdio.c",
"function": "btsdio_remove"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 232.0,
"function_hash": "188455809214649793169707422291375045634"
}
},
{
"id": "CVE-2023-53145-dc16c379",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efcbf25e5ab4d4ad1b7e6ba0869ff85540e3f6e",
"target": {
"file": "drivers/bluetooth/btsdio.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"148564765528288551965488868753689762175",
"321482510539291641984312513663499579674",
"15893087554719779091093379056268859966"
],
"threshold": 0.9
}
}
]