CVE-2023-2002

What it actually does

Missing capability check in net/bluetooth/hci_sock.c permits local processes to execute Bluetooth management commands without required privileges, bypassing authorization controls on HCI sockets.

Why it matters to the business

Attackers can disrupt, intercept, or manipulate Bluetooth communications on Linux systems, potentially exposing sensitive data or causing device availability issues in environments relying on wireless peripherals or IoT integrations.

How an attack unfolds

An attacker with local access on a vulnerable Linux kernel crafts HCI socket requests that skip the absent capability validation, directly issuing management commands to alter Bluetooth state, pair devices, or exfiltrate data without elevated privileges.

How to fix it

Update the Linux kernel to the fixed commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 or later; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the capability check is present in net/bluetooth/hci_sock.c after patching, then verify that non-privileged processes receive permission errors when attempting management commands.

Typical attack path

1. Locate a Linux system running a vulnerable kernel version with Bluetooth enabled
2. Obtain local user-level access on the target
3. Open an HCI socket and issue unauthorized management commands
4. Execute actions that compromise Bluetooth confidentiality, integrity, or availability

How to detect it

Inspect kernel logs and audit trails for HCI socket operations originating from non-privileged processes or unexpected Bluetooth management events.

What your security team should do

• Prioritize kernel upgrade to the referenced fixed commit on all production systems
• Temporarily disable Bluetooth interfaces via rfkill where the functionality is unnecessary
• Audit local user permissions and remove unnecessary access to socket operations