CVE-2023-28464 - Double Free Vulnerability in Linux Bluetooth hci_conn

The Linux kernel is the backbone of countless devices—from servers and desktops to smartphones and IoT gadgets. But even the kernel isn’t flawless. In March 2023, security researchers discovered a serious vulnerability tracked as CVE-2023-28464. This bug puts millions of Linux devices at risk of privilege escalation by exploiting the Bluetooth stack.

In plain English, this is about a double free bug in the kernel’s Bluetooth code. Why does that matter? Because double frees can lead to use-after-free errors, memory corruption, and ultimately, allow attackers to run code with kernel (root) privileges.

Let’s break down CVE-2023-28464, see actual code snippets, understand the exploit, and look at references to original sources.

Component: Bluetooth subsystem in Linux kernel

- Affected File: net/bluetooth/hci_conn.c

Vulnerable Function: hci_conn_cleanup, particularly as seen in hci_conn_hash_flush

- Problem: Double free due to improper management of reference counters in kernel Bluetooth connections

How It Happens

Inside the hci_conn_cleanup function, when cleaning up Bluetooth connections, the kernel calls both hci_dev_put and hci_conn_put. If not properly checked, both can release (free) the same memory twice—a classic “double free” bug.

That’s dangerous! It lets an attacker force the kernel to reuse freed memory, making it possible to execute malicious code as if they were root.

Let’s look at the problematic code (from net/bluetooth/hci_conn.c)

void hci_conn_cleanup(struct hci_conn *conn)
{
    ...
    hci_dev_put(hdev);     // decrements device refcount, may free it!
    hci_conn_put(conn);    // decrements connection refcount, may free it!
    ...
}

But if you look at where hci_conn_hash_flush calls this cleanup function, it may also release one or both references *again*.

Potential Call Stack Leading to Double Free

// In net/bluetooth/hci_conn.c
void hci_conn_hash_flush(struct hci_dev *hdev)
{
    ...
    hci_conn_cleanup(conn); // here
    ...
}

So, depending on how references were handled before, the object being pointed to could be released and freed twice—causing unpredictable kernel behavior.

*This is a simplified view. For the full context, see the commit diff that fixed the bug.*

Allow an attacker to control what gets written to which memory address

Attackers can craft fake data structures, trick the kernel into running their code, and escalate privileges to root. This is especially bad if the exploit works remotely (say, over Bluetooth).

Triggering the Vulnerability (Exploit Details)

Because this bug lives in the Bluetooth code, any process that can interact with Bluetooth sockets could, in theory, trigger the issue. Here’s a high-level scenario:

Connect: Attacker opens a Bluetooth connection via a crafted program.

2. Close & Cleanup: The kernel’s Bluetooth code cleans up the connection with incorrect reference counting.

Example Proof of Concept (PoC) Pseudocode

// This is an illustrative PoC; do NOT use maliciously
int main() {
    int sock = socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_HCI);
    struct sockaddr_hci addr = { ... };
    // connect/disconnect rapidly, trigger cleanup race
    close(sock);
    // More operations to trigger refcount issues...
    return ;
}

(Note: Reliable exploitation requires deep understanding of kernel memory management, but even minor memory corruption here is worrying!)

Official References & Fixes

- Original Patch Commit
- NVD Entry for CVE-2023-28464
- Linux Bluetooth Subsystem Maintainers

Am I Affected? How Do I Fix It?

- Am I Vulnerable? If you use Linux kernel up to version 6.2.9 and have Bluetooth enabled, YOU *might* be.
- How To Fix: Upgrade your kernel! Distributions like Ubuntu, Fedora, and Debian have already included security patches. At a minimum, disable Bluetooth if you cannot update.

Check your kernel version

uname -r

Update your system

sudo apt update && sudo apt upgrade         # Debian/Ubuntu
sudo dnf upgrade --refresh                  # Fedora
sudo pacman -Syu                            # Arch

Conclusion

CVE-2023-28464 is a harsh reminder of how subtle kernel mistakes can have big security impacts. This double free bug in Linux Bluetooth code can be a direct path to root privileges if left unpatched.

Patch your systems. Watch for update notices from your distro. If you’re writing kernel code, double- (or triple-) check your reference handling and free logic!

Stay safe and keep your kernel up to date.

If you found this post helpful, check out the Linux Kernel Mailing List Archive for more kernel info and updates.

Timeline

Published on: 03/31/2023 16:15:00 UTC
Last modified on: 05/17/2023 20:15:00 UTC

CVE-2023-28464 - Double Free Vulnerability in Linux Bluetooth hci_conn_cleanup ([Exploit Details & Code])