CVE-2023-28866

What it actually does

Out-of-bounds memory access in the Linux kernel Bluetooth HCI synchronization code path due to amp_init1 and amp_init2 arrays lacking an expected sentinel invalid element, enabling partial information disclosure.

Why it matters to the business

Low-risk exposure allowing remote attackers to read limited kernel memory over the network without authentication; widespread Linux kernel deployment increases potential blast radius in servers, embedded devices, and cloud workloads despite low exploitability.

How an attack unfolds

An unauthenticated attacker sends specially crafted Bluetooth AMP management packets that trigger the malformed array initialization in hci_sync.c, resulting in an out-of-bounds read that leaks kernel memory contents.

How to fix it

Upgrade the Linux kernel to a version containing the corrected amp_init array definitions; apply vendor-supplied patches addressing the missing sentinel element; disable Bluetooth AMP support if unused.

How to confirm the fix worked

Verify kernel source or binary contains proper amp_init1/amp_init2 sentinel values; run regression tests exercising Bluetooth AMP initialization paths; confirm no OOB access via memory sanitizer instrumentation.

Typical attack path

1. Identify reachable Linux systems exposing Bluetooth AMP interfaces
2. Craft and transmit malformed HCI AMP initialization packets
3. Trigger out-of-bounds array access during hci_sync processing
4. Read leaked kernel memory to gather information for further attacks

How to detect it

Review kernel logs for Bluetooth HCI sync errors or warnings around amp_init; inspect network traffic for anomalous AMP management frames; use kernel memory debugging tools to detect OOB reads during Bluetooth activity.

What your security team should do

• Prioritize kernel updates on internet-facing or multi-tenant systems
• Audit Bluetooth configuration and disable AMP where possible
• Monitor for new kernel releases addressing this class of array initialization errors
• Incorporate memory-safety testing for Bluetooth stack changes