CVE-2023-54210

What it actually does

Use-after-free in the hci_remove_adv_monitor path when the MSFT extension monitor removal frees the monitor structure before bt_dev_dbg accesses it under the HCI_ADV_MONITOR_EXT_MSFT case.

Why it matters to the business

Kernel instability or memory corruption on Linux systems using Bluetooth advertisement monitoring, potentially causing crashes or opening paths to privilege escalation in affected kernels.

How an attack unfolds

An attacker with local access triggers advertisement monitor removal under MSFT extension conditions, causing msft_remove_monitor_sync to free the structure that is later dereferenced in a debug print, resulting in use-after-free.

How to fix it

Update the Linux kernel to a version containing commit 0d4d6b083da9b033ddccef72d77f373c819ae3ea or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the presence of commit 0d4d6b083da9b033ddccef72d77f373c819ae3ea in the running kernel source; verify no KASAN reports for hci_remove_adv_monitor after applying the update.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel with Bluetooth enabled
2. Register or manipulate advertisement monitors that invoke the MSFT extension path
3. Trigger hci_remove_adv_monitor to enter the freeing code path in msft_le_cancel_monitor_advertisement_cb
4. Cause subsequent access to the freed monitor object via bt_dev_dbg

How to detect it

Review kernel logs for KASAN use-after-free reports referencing hci_remove_adv_monitor or msft_remove_monitor; inspect dmesg and audit logs around Bluetooth monitor registration events.

What your security team should do

• Prioritize kernel updates on all Bluetooth-enabled systems within the next maintenance window
• Monitor vendor advisories for backported fixes in distribution kernels
• Limit unprivileged local access on high-value systems until patched