CVE-2023-54120

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the hidp_session_thread can lead to a use-after-free vulnerability. This occurs when a timer is active while its deletion function is called, causing memory to be accessed after it has been freed. A local attacker could exploit this to trigger a kernel panic, resulting in a Denial of Service (DoS) to the system.

This vulnerability is classified as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires an attacker to possess local authenticated access and trigger a narrow race window during Bluetooth HID connection teardown. Although improper timer cancellation can result in memory corruption or a kernel crash, the prerequisites demand active Bluetooth hardware and active HID device sessions, which are generally absent on standard enterprise server deployments. Consequently, the practical risk is constrained primarily to workstations or systems with attached Bluetooth peripherals.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Bluetooth service if it is not required. This can be achieved by stopping and disabling the bluetooth service and preventing the bluetooth kernel module from loading.

To stop and disable the Bluetooth service:

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth

To prevent the bluetooth kernel module from loading at boot, create a modprobe configuration file:

echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf

A system reboot is required for the kernel module change to take full effect. Disabling Bluetooth will impact any functionality that relies on Bluetooth connectivity.