01 Record

CVE-2023-28464

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.27% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 19.5% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2023-03-31 00:00Z3 YR AGO

Last updated

2024-08-02 12:38Z2 YR AGO

Reserved

2023-03-15

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-415Double FreeVariant

Data version

5.1

Document digest

9b5320e69a16ea29f7323e7538b7ded0a0830b3cc88270ee992a37f2213a4d44

05 Affected products

VendorProductVersionsPlatforms

linuxlinux_kernelNot specified—

netapph300s_firmwareNot specified—

netapph410c_firmwareNot specified—

netapph410s_firmwareNot specified—

netapph500s_firmwareNot specified—

netapph700s_firmwareNot specified—

redhatenterprise_linuxNot specified—

06 References

lore.kernel.orghttps://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/
www.openwall.comhttps://www.openwall.com/lists/oss-security/2023/03/28/2
www.openwall.comhttps://www.openwall.com/lists/oss-security/2023/03/28/3
security.netapp.comhttps://security.netapp.com/advisory/ntap-20230517-0004/

07 Fixed in

AlmaLinux 8

bpftool
Fixed in 4.18.0-553.el8_10
kernel
Fixed in 4.18.0-553.el8_10
kernel-abi-stablelists
Fixed in 4.18.0-553.el8_10
kernel-core
Fixed in 4.18.0-553.el8_10
kernel-cross-headers
Fixed in 4.18.0-553.el8_10
kernel-debug
Fixed in 4.18.0-553.el8_10
kernel-debug-core
Fixed in 4.18.0-553.el8_10
kernel-debug-devel
Fixed in 4.18.0-553.el8_10
kernel-debug-modules
Fixed in 4.18.0-553.el8_10
kernel-debug-modules-extra
Fixed in 4.18.0-553.el8_10
kernel-devel
Fixed in 4.18.0-553.el8_10
kernel-doc
Fixed in 4.18.0-553.el8_10
kernel-headers
Fixed in 4.18.0-553.el8_10
kernel-modules
Fixed in 4.18.0-553.el8_10
kernel-modules-extra
Fixed in 4.18.0-553.el8_10
kernel-rt
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-core
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-core
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-devel
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-kvm
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-modules
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-modules-extra
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-devel
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-kvm
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-modules
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-modules-extra
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-tools
Fixed in 4.18.0-553.el8_10
kernel-tools-libs
Fixed in 4.18.0-553.el8_10
kernel-tools-libs-devel
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-core
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-devel
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-modules
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-modules-extra
Fixed in 4.18.0-553.el8_10
perf
Fixed in 4.18.0-553.el8_10
python3-perf
Fixed in 4.18.0-553.el8_10

AlmaLinux 9

bpftool
Fixed in 7.3.0-427.13.1.el9_4
kernel
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-abi-stablelists
Fixed in 5.14.0-427.13.1.el9_4
kernel-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-cross-headers
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-uki-virt
Fixed in 5.14.0-427.13.1.el9_4
kernel-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-doc
Fixed in 5.14.0-427.13.1.el9_4
kernel-headers
Fixed in 5.14.0-427.13.1.el9_4
kernel-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug-modules
Fixed in 5.14.0-427.13.1.el9_4

22 further packages in AlmaLinux 9 not shown (first 40 listed).

CloudLinux 8

bpftool
Fixed in 4.18.0-553.el8_10
kernel
Fixed in 4.18.0-553.el8_10
kernel-abi-stablelists
Fixed in 4.18.0-553.el8_10
kernel-core
Fixed in 4.18.0-553.el8_10
kernel-cross-headers
Fixed in 4.18.0-553.el8_10
kernel-debug
Fixed in 4.18.0-553.el8_10
kernel-debug-core
Fixed in 4.18.0-553.el8_10
kernel-debug-devel
Fixed in 4.18.0-553.el8_10
kernel-debug-modules
Fixed in 4.18.0-553.el8_10
kernel-debug-modules-extra
Fixed in 4.18.0-553.el8_10
kernel-devel
Fixed in 4.18.0-553.el8_10
kernel-doc
Fixed in 4.18.0-553.el8_10
kernel-headers
Fixed in 4.18.0-553.el8_10
kernel-modules
Fixed in 4.18.0-553.el8_10
kernel-modules-extra
Fixed in 4.18.0-553.el8_10
kernel-rt
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-core
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-core
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-devel
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-kvm
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-modules
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-modules-extra
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-devel
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-kvm
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-modules
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-rt-modules-extra
Fixed in 4.18.0-553.rt7.342.el8_10
kernel-tools
Fixed in 4.18.0-553.el8_10
kernel-tools-libs
Fixed in 4.18.0-553.el8_10
kernel-tools-libs-devel
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-core
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-devel
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-modules
Fixed in 4.18.0-553.el8_10
kernel-zfcpdump-modules-extra
Fixed in 4.18.0-553.el8_10
perf
Fixed in 4.18.0-553.el8_10
python3-perf
Fixed in 4.18.0-553.el8_10

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

bpftool
Fixed in 7.3.0-427.13.1.el9_4
kernel
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-debug-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-64k-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-abi-stablelists
Fixed in 5.14.0-427.13.1.el9_4
kernel-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-cross-headers
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-debug-uki-virt
Fixed in 5.14.0-427.13.1.el9_4
kernel-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-devel-matched
Fixed in 5.14.0-427.13.1.el9_4
kernel-doc
Fixed in 5.14.0-427.13.1.el9_4
kernel-headers
Fixed in 5.14.0-427.13.1.el9_4
kernel-modules
Fixed in 5.14.0-427.13.1.el9_4
kernel-modules-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-modules-extra
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug-core
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug-devel
Fixed in 5.14.0-427.13.1.el9_4
kernel-rt-debug-modules
Fixed in 5.14.0-427.13.1.el9_4

22 further packages in CloudLinux 9 not shown (first 40 listed).

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Ubuntu 16.04 LTS

linux-hwe-edge
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

linux-aws-5.0
No fix yet
linux-aws-5.3
No fix yet
linux-azure
No fix yet
linux-azure-5.3
No fix yet
linux-azure-edge
No fix yet
linux-gcp
No fix yet
linux-gcp-5.3
No fix yet
linux-gke-4.15
No fix yet
linux-gke-5.4
No fix yet
linux-gkeop-5.4
No fix yet
linux-hwe
No fix yet
linux-hwe-edge
No fix yet
linux-oem
No fix yet
linux-oracle-5.0
No fix yet
linux-oracle-5.3
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

linux-aws-5.11
No fix yet
linux-aws-5.13
No fix yet
linux-aws-5.8
No fix yet
linux-azure-5.11
No fix yet
linux-azure-5.13
No fix yet
linux-azure-5.8
No fix yet
linux-gcp-5.11
No fix yet
linux-gcp-5.13
No fix yet
linux-gcp-5.8
No fix yet
linux-hwe-5.11
No fix yet
linux-hwe-5.13
No fix yet
linux-hwe-5.8
No fix yet
linux-intel-5.13
No fix yet
linux-oem-5.10
No fix yet
linux-oem-5.13
No fix yet
linux-oem-5.14
No fix yet
linux-oem-5.6
No fix yet
linux-oracle-5.11
No fix yet
linux-oracle-5.13
No fix yet
linux-oracle-5.8
No fix yet
linux-raspi2
No fix yet
linux-riscv
No fix yet
linux-riscv-5.11
No fix yet
linux-riscv-5.8
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

linux-riscv
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.