Memory Leak Vulnerability in Linux Kernel Bluetooth Package
Summary
CVE-2023-53018: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leaks When hci_cmd_sync_queue() failed in hci_le_terminate_big() or hci_le_big_terminate(), the memory pointed by variab... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware communication. The Bluetooth subsystem within the kernel enables wireless communication between devices. This subsystem is crucial for various applications, including file transfers and audio streaming. However, it is susceptible to vulnerabilities that can lead to performance issues and security risks.
Vulnerability Detail
The vulnerability identified as CVE-2023-53018 arises from a memory leak in the Bluetooth subsystem of the Linux kernel. Specifically, when the function hci_cmd_sync_queue() fails during the execution of hci_le_terminate_big() or hci_le_big_terminate(), the memory allocated to the variable 'd' is not released. This oversight can lead to increased memory consumption, potentially degrading system performance over time. If left unaddressed, it could result in denial of service due to resource exhaustion.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2023-53018 is a significant vulnerability in the Linux kernel's Bluetooth subsystem that can lead to memory leaks and system performance issues. Users are encouraged to update their kernel to the patched version 6.1.11-1 to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53018 is a vulnerability in the Linux kernel's Bluetooth subsystem that causes memory leaks when certain commands fail.
This vulnerability can lead to increased memory usage, potentially causing system slowdowns or crashes due to resource exhaustion.
Yes, a patch is available in version 6.1.11-1 for Debian 12 and 13. Users should update their kernel to this version.
While there are no specific workarounds, it is advisable to monitor system performance and apply the patch as soon as possible.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.