CVE-2023-28464

What it actually does

Use-after-free in hci_conn_cleanup due to improper reference counting with hci_dev_put and hci_conn_put, leading to double free during hci_conn_hash_flush and potential privilege escalation on the local system.

Why it matters to the business

Local attackers on affected Linux systems could obtain elevated privileges, increasing risk of full system compromise on servers, workstations, and embedded devices using the Bluetooth stack.

How an attack unfolds

An attacker with local access triggers Bluetooth connection cleanup routines, exploiting the reference counting flaw to cause a double free that corrupts kernel memory and allows execution of arbitrary code with elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the reference counting issue in hci_conn.c; apply vendor-supplied patches to NetApp storage firmware where applicable; disable Bluetooth if unused.

How to confirm the fix worked

Verify the running kernel version exceeds 6.2.9 and contains the corrected hci_conn_cleanup logic; review kernel source or changelog for the fix; test Bluetooth connection teardown under load to confirm absence of double-free behavior.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Trigger Bluetooth HCI connection operations that invoke hci_conn_cleanup
3. Force hci_conn_hash_flush to dereference freed memory
4. Exploit resulting double free for kernel memory corruption
5. Escalate privileges to root or kernel level

How to detect it

Examine kernel logs for oops or panic messages involving hci_conn_cleanup or hci_conn_hash_flush; look for unusual Bluetooth-related process activity or crashes shortly before privilege changes; review audit logs for unexpected setuid or capability changes following Bluetooth operations.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-user Linux systems within the next patching cycle
• Disable the Bluetooth kernel module via blacklist if the functionality is not required
• Monitor upstream Linux kernel security announcements for backported fixes to older stable branches
• Review and restrict local user privileges to reduce attack surface for local privilege escalation