CVE-2023-28464
published 2023-03-31CVE-2023-28464: hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.27%
19.5th percentile
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| msrc | cbl2_kernel_5.15.122.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.188.1-1_on_cbl_mariner_1.0 | — | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3cpr-9mc9-3vfm: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix double free in hci_conn_cleanup
syzbot reports a slab use-after-f
ghsa_unreviewed·2024-05-21·CVSS 7.8
CVE-2023-52830 [HIGH] GHSA-3cpr-9mc9-3vfm: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix double free in hci_conn_cleanup
syzbot reports a slab use-after-f
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix double free in hci_conn_cleanup
syzbot reports a slab use-after-free in hci_conn_hash_flush [1].
After releasing an object using hci_conn_del_sysfs in the
hci_conn_cleanup function, releasing the same object again
using the hci_dev_put and hci_conn_put functions causes a double free.
Here's a simplified flow:
hci_conn_del_sysfs:
hci_dev_put
put_device
kobject_put
kref_put
kobject_release
kobject_cleanup
kfree_const
kfree(name)
hci_dev_put:
...
kfree(name)
hci_conn_put:
put_device
...
kfree(name)
This patch drop the hci_dev_put and hci_conn_put function
call in hci_conn_cleanup function, because the object is
freed in hci_conn_del_sysfs function.
This patch also fixes the refcounting in hci_conn_add_sy
Kernel
Bluetooth: Fix double free in hci_conn_cleanup
kernel_security·2023-10-18·CVSS 7.8
CVE-2023-28464 [HIGH] Bluetooth: Fix double free in hci_conn_cleanup
Bluetooth: Fix double free in hci_conn_cleanup
syzbot reports a slab use-after-free in hci_conn_hash_flush [1].
After releasing an object using hci_conn_del_sysfs in the
hci_conn_cleanup function, releasing the same object again
using the hci_dev_put and hci_conn_put functions causes a double free.
Here's a simplified flow:
hci_conn_del_sysfs:
hci_dev_put
put_device
kobject_put
kref_put
kobject_release
kobject_cleanup
kfree_const
kfree(name)
hci_dev_put:
...
kfree(name)
hci_conn_put:
put_device
...
kfree(name)
This patch drop the hci_dev_put and hci_conn_put function
call in hci_conn_cleanup function, because the object is
freed in hci_conn_del_sysfs function.
This patch also fixes the refcounting in hci_conn_add_sysfs() and
hci_conn_del_sysfs() to take into account device_add() fail
GHSA
GHSA-p5r5-29j4-g3f7: hci_conn_cleanup in net/bluetooth/hci_conn
ghsa_unreviewed·2023-03-31
CVE-2023-28464 [HIGH] CWE-415 GHSA-p5r5-29j4-g3f7: hci_conn_cleanup in net/bluetooth/hci_conn
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
OSV
CVE-2023-28464: hci_conn_cleanup in net/bluetooth/hci_conn
osv·2023-03-31·CVSS 7.8
CVE-2023-28464 [HIGH] CVE-2023-28464: hci_conn_cleanup in net/bluetooth/hci_conn
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
Palo Alto
PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS
vendor_paloalto·2026-04-08·CVSS 7.8
CVE-2023-2176 [HIGH] PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS
PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2023-2176, CVE-2023-28464, CVE-2023-5633, CVE-2024-0646, CVE-2024-36886, CVE-2024-36971, CVE-2025-57052
Affected products: PAN-OS
Red Hat
Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
vendor_redhat·2023-03-28·CVSS 7.8
CVE-2023-28464 [HIGH] CWE-415 Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
A double-free vulnerability was found in the hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux Kernel. This issue may cause a denial of service or privilege escalation.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Microsoft
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a doubl
vendor_msrc·2023-03-14·CVSS 7.8
CVE-2023-28464 [HIGH] CWE-415 hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a doubl
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to addition
Debian
CVE-2023-28464: linux - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 h...
vendor_debian·2023·CVSS 7.8
CVE-2023-28464 [HIGH] CVE-2023-28464: linux - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 h...
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
arXiv
Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects
arxiv_fulltext·2024-08-19
Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects
Top of the Heap: Efficient Memory Error Protection
of Safe Heap Objects
0
@IEEEauthorhalign
@IEEEauthorhalign
Kaiming Huang
Penn State University
[email protected]
Mathias Payer
EPFL
[email protected]
Zhiyun Qian
UC Riverside
[email protected]
Jack Sampson
Penn State University
[email protected]
\ \ \ \ Gang Tan
\ \ \ \ Penn State University
\ \ \ \ [email protected]
Trent Jaeger
Penn State University
[email protected]
Kaiming Huang
Penn State University
[email protected]
Mathias Payer
EPFL
[email protected]
Zhiyun Qian
UC Riverside
[email protected]
Jack Sampson
Penn State University
[email protected]
Gang Tan
Penn State University
[email protected]
Trent Jaeger
UC Riverside
[email protected]
0
CCSXML
10002978.10003022.10003023
Security and privacy Software
Bugzilla
CVE-2023-28464 Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
bugzilla·2023-03-13·CVSS 7.8
CVE-2023-28464 [HIGH] CVE-2023-28464 Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
CVE-2023-28464 Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
A double free vulnerability was found in the hci_conn_cleanup function of net/bluetooth/hci_conn.c, which may cause DOS or privilege escalation.
Version: Linux kernel 6.2 (this problem also exists in 6.3-rc1)
At the end of the hci_conn_del_sysfs(conn) function in the hci_conn_cleanup function, hci_dev_put(hdev) will be called. The hci_dev_put function will eventually call kfree to release the space used by name:
```
hci_dev_put
put_device
kobject_put
kref_put
kobject_release
kobject_cleanup
kfree_const
kfree
```
After the hci_conn_del_sysfs function ends, the hci_dev_put function is called again in the hci_conn_cleanup function, and their parameters hdev are the same, so double free will be caused whe
https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/https://security.netapp.com/advisory/ntap-20230517-0004/https://www.openwall.com/lists/oss-security/2023/03/28/2https://www.openwall.com/lists/oss-security/2023/03/28/3https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/https://security.netapp.com/advisory/ntap-20230517-0004/https://www.openwall.com/lists/oss-security/2023/03/28/2https://www.openwall.com/lists/oss-security/2023/03/28/3
2023-03-31
Published