CVE-2023-54120

What it actually does

Use-after-free in hidp_session_thread caused by race between active timer and hidp_del_timer followed by hidp_session_put, allowing hidp_idle_timeout to access freed session object and trigger kernel panic.

Why it matters to the business

Linux systems using Bluetooth HID devices may experience sudden kernel panics and reboots, resulting in loss of availability and potential data corruption on affected hosts.

How an attack unfolds

An attacker with local access or the ability to interact with Bluetooth HIDP sessions triggers concurrent timer activation and session deletion; when the timeout fires on the freed session object the kernel panics.

How to fix it

Upgrade the Linux kernel to commit 152f47bd6b995e0e98c85672f6d19894bc287ef2 or any later stable tree containing the replacement of del_timer with del_timer_sync in hidp_session_thread.

How to confirm the fix worked

Confirm the patched source contains del_timer_sync, rebuild and boot the kernel, then exercise HIDP session creation and deletion under timer load to verify no use-after-free occurs.

Typical attack path

1. Establish Bluetooth HIDP session
2. Ensure timer is armed
3. Invoke hidp_del_timer concurrently with session cleanup
4. Free session via hidp_session_put
5. Timer callback hidp_idle_timeout dereferences freed memory

How to detect it

Search kernel logs and crash dumps for call traces containing hidp_session_probe, hidp_idle_timeout, __run_timers, and hidp_session_thread; correlate with Bluetooth device attach events.

• hidp_idle_timeout
• hidp_session_thread
• hidp_del_timer
• call_timer_fn.*hidp
• BUG: KASAN: use-after-free in hidp

What your security team should do

• Apply the referenced kernel commit or distribution update with highest priority on Bluetooth-enabled systems
• Disable Bluetooth kernel modules if HIDP functionality is not required
• Add kernel panic monitoring for hidp-related call traces
• Track downstream distribution advisories for backported fixes