CVE-2023-53017

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53017
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR to pass the instance to callback so no memory needs to be allocated.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1ed8b37cbaf14574c779064ef1372af62e8ba6aa Patch
https://git.kernel.org/stable/c/8ac6043bd3e5b58d30f50737aedc2e58e8087ad5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
History

15 Apr 2025, 19:41

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: hci_sync: corrige pérdida de memoria en hci_update_adv_data() Cuando hci_cmd_sync_queue() falla en hci_update_adv_data(), inst_ptr no se libera, lo que provocará una pérdida de memoria. Convierta para usar ERR_PTR/PTR_ERR para pasar la instancia a la devolución de llamada, de modo que no sea necesario asignar memoria.
References () https://git.kernel.org/stable/c/1ed8b37cbaf14574c779064ef1372af62e8ba6aa - () https://git.kernel.org/stable/c/1ed8b37cbaf14574c779064ef1372af62e8ba6aa - Patch
References () https://git.kernel.org/stable/c/8ac6043bd3e5b58d30f50737aedc2e58e8087ad5 - () https://git.kernel.org/stable/c/8ac6043bd3e5b58d30f50737aedc2e58e8087ad5 - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

27 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 17:15

Updated : 2025-04-15 19:41

NVD link : CVE-2023-53017

Mitre link : CVE-2023-53017

CVE.ORG link : CVE-2023-53017

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime