CVE-2023-31083

What it actually does

Race condition in hci_uart_tty_ioctl allows HCI_UART_PROTO_SET to be set before hu->proto, enabling a NULL pointer dereference on subsequent HCIUARTGETPROTO calls.

Why it matters to the business

Local denial of service on systems using affected Bluetooth UART drivers can interrupt device operations and require reboots or restarts, with low likelihood of remote exploitation.

How an attack unfolds

A local attacker with access to the Bluetooth TTY device issues concurrent HCIUARTSETPROTO and HCIUARTGETPROTO ioctls to trigger the window where the protocol flag is set without the protocol pointer, causing a kernel NULL dereference and potential crash.

How to fix it

Upgrade the Linux kernel to the fixed commit 9c33663af9ad115f90c076a1828129a3fbadea98 or later; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel source contains commit 9c33663af9ad115f90c076a1828129a3fbadea98; test that concurrent HCIUARTSETPROTO and HCIUARTGETPROTO ioctls no longer produce a NULL dereference.

Typical attack path

1. Obtain local user access on a Linux system with the vulnerable hci_ldisc driver loaded
2. Open the Bluetooth UART TTY device file
3. Issue concurrent HCIUARTSETPROTO and HCIUARTGETPROTO ioctl calls to race the protocol assignment
4. Trigger NULL pointer dereference leading to kernel panic or process termination

How to detect it

Review kernel logs for NULL pointer dereference crashes in hci_uart_tty_ioctl or hci_ldisc; inspect audit logs for unusual ioctl activity on Bluetooth TTY devices around the time of any kernel oops or panic.

What your security team should do

• Prioritize kernel updates on any systems exposing Bluetooth UART TTY interfaces
• Monitor for local privilege or crash attempts involving hci_ldisc ioctls
• Apply the fix commit during the next maintenance window if not already deployed