Memory Leak Vulnerability in Linux Kernel Bluetooth Package - CVE-2023-53017
Summary
CVE-2023-53017: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which wi... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is widely used in various distributions, including Debian. The Bluetooth subsystem within the kernel enables wireless communication with Bluetooth devices. This subsystem is critical for functionalities such as file transfers, audio streaming, and device pairing. However, vulnerabilities within this subsystem can lead to significant issues, including memory leaks that affect system performance.
Vulnerability Detail
CVE-2023-53017 is a vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_update_adv_data() function. The issue arises when the hci_cmd_sync_queue() function fails, leading to the failure to free the inst_ptr, which results in a memory leak. This leak can accumulate over time, potentially exhausting system memory and degrading performance. The vulnerability has been addressed in version 6.1.11-1 of the Linux package for Debian.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2023-53017 is a critical vulnerability in the Linux kernel's Bluetooth subsystem that can lead to memory leaks. It is essential to update to the patched version 6.1.11-1 to mitigate this risk. Monitoring tools like Vulert can help keep your software secure by alerting you to vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53017 is a vulnerability in the Linux kernel's Bluetooth subsystem that causes a memory leak when certain commands fail.
The memory leak can lead to increased memory usage over time, potentially causing system slowdowns or crashes.
If you are running a version of the Linux kernel prior to 6.1.11-1, your system may be vulnerable to this issue.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system's memory usage and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
