CVE-2023-52518

Bluetooth: hci_codec: Fix leaking content of local_codecs

State
Published
Severity
5.5 Medium
Published
Mar 2, 2024
Updated
May 11, 2026
Reserved
Feb 20, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_codec: Fix leaking content of local_codecs

The following memory leak can be observed when the controller supports codecs which are stored in local_codecs list but the elements are never freed:

unreferenced object 0xffff88800221d840 (size 32): comm "kworker/u3:0", pid 36, jiffies 4294898739 (age 127.060s) hex dump (first 32 bytes): f8 d3 02 03 80 88 ff ff 80 d8 21 02 80 88 ff ff ..........!..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffffb324f557>] __kmalloc+0x47/0x120 [<ffffffffb39ef37d>] hci_codec_list_add.isra.0+0x2d/0x160 [<ffffffffb39ef643>] hci_read_codec_capabilities+0x183/0x270 [<ffffffffb39ef9ab>] hci_read_supported_codecs+0x1bb/0x2d0 [<ffffffffb39f162e>] hci_read_local_codecs_sync+0x3e/0x60 [<ffffffffb39ff1b3>] hci_dev_open_sync+0x943/0x11e0 [<ffffffffb396d55d>] hci_power_on+0x10d/0x3f0 [<ffffffffb30c99b4>] process_one_work+0x404/0x800 [<ffffffffb30ca134>] worker_thread+0x374/0x670 [<ffffffffb30d9108>] kthread+0x188/0x1c0 [<ffffffffb304db6b>] ret_from_fork+0x2b/0x50 [<ffffffffb300206a>] ret_from_fork_asm+0x1a/0x30

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
LinuxLinux
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to before 626535077ba9dc110787540d1fe24881094c15a1Affected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to before eea5a8f0c3b7c884d2351e75fbdd0a3d7def5ae1Affected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to before b938790e70540bf4f2e653dcd74b232494d06c8fAffected
LinuxLinux
  • 5.16Affected
  • before 5.16Not affected
  • 6.1.57 through 6.1.*Not affected
  • 6.5.7 through 6.5.*Not affected
  • 6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.