In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
In btsdioprobe, the data->work is bound with btsdiowork. It will be started in btsdiosendframe.
If the btsdioremove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdiowork. Fix it by canceling the work before do cleanup in btsdio_remove.
[ { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c2a467e9e789ae0891de55b766daac52e3b7b3", "signature_version": "v1", "target": { "file": "drivers/bluetooth/btsdio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "148564765528288551965488868753689762175", "321482510539291641984312513663499579674", "15893087554719779091093379056268859966" ] }, "id": "CVE-2023-53145-0ad9df47" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7b171b7c09139eb3c6a5677c200dc1be5f318", "signature_version": "v1", "target": { "file": "drivers/bluetooth/btsdio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "170143361810945339656031389852500433063", "321482510539291641984312513663499579674", "15893087554719779091093379056268859966" ] }, "id": "CVE-2023-53145-0e481992" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7b171b7c09139eb3c6a5677c200dc1be5f318", "signature_version": "v1", "target": { "function": "btsdio_remove", "file": "drivers/bluetooth/btsdio.c" }, "digest": { "function_hash": "286875961747049385681922624464955100069", "length": 261.0 }, "id": "CVE-2023-53145-14a785ab" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c2a467e9e789ae0891de55b766daac52e3b7b3", "signature_version": "v1", "target": { "function": "btsdio_remove", "file": "drivers/bluetooth/btsdio.c" }, "digest": { "function_hash": "188455809214649793169707422291375045634", "length": 232.0 }, "id": "CVE-2023-53145-4f40d8df" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@746b363bef41cc159c051c47f9e30800bc6b520d", "signature_version": "v1", "target": { "file": "drivers/bluetooth/btsdio.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "148564765528288551965488868753689762175", "321482510539291641984312513663499579674", "15893087554719779091093379056268859966" ] }, "id": "CVE-2023-53145-6413fbcf" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@746b363bef41cc159c051c47f9e30800bc6b520d", "signature_version": "v1", "target": { "function": "btsdio_remove", "file": "drivers/bluetooth/btsdio.c" }, "digest": { "function_hash": "188455809214649793169707422291375045634", "length": 232.0 }, "id": "CVE-2023-53145-6fc98056" } ]