CVE-2023-53252

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync

hci_update_accept_list_sync iterates over hdev->pend_le_conns and

hdev->pend_le_reports, and waits for controller events in the loop body,

without holding hdev lock.

Meanwhile, these lists and the items may be modified e.g. by

le_scan_cleanup. This can invalidate the list cursor or any other item

in the list, resulting to invalid behavior (eg use-after-free).

Use RCU for the hci_conn_params action lists. Since the loop bodies in

hci_sync block and we cannot use RCU or hdev->lock for the whole loop,

copy list items first and then iterate on the copy. Only the flags field

is written from elsewhere, so READ_ONCE/WRITE_ONCE should guarantee we

read valid values.

Free params everywhere with hci_conn_params_free so the cleanup is

guaranteed to be done properly.

This fixes the following, which can be triggered e.g. by BlueZ new

mgmt-tester case "Add +

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References