CVE-2023-28866: Linux Kernel Buffer Overflow Vulnerability

CVE-2023-28866 Overview

CVE-2023-28866 affects the Linux kernel through version 6.2.8. The vulnerability resides in net/bluetooth/hci_sync.c and stems from missing sentinel entries in the amp_init1[] and amp_init2[] arrays. These arrays were supposed to contain an intentionally invalid element to mark their end, but the terminator was absent. The defect enables out-of-bounds access during Bluetooth Host Controller Interface (HCI) synchronization. The flaw is classified under [CWE-125] Out-of-Bounds Read.

Critical Impact
A remote attacker within Bluetooth range can trigger out-of-bounds memory reads in the kernel Bluetooth stack, leading to limited information disclosure from kernel memory.

Affected Products

Linux kernel versions up to and including 6.2.8
Distributions shipping vulnerable net/bluetooth/hci_sync.c
Systems with Bluetooth AMP (Alternate MAC/PHY) functionality enabled

Discovery Timeline

2023-03-27 - CVE-2023-28866 published to NVD
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2023-28866

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the Linux kernel Bluetooth subsystem. The file net/bluetooth/hci_sync.c iterates over the static arrays amp_init1[] and amp_init2[] during AMP controller initialization. The iteration logic relies on a sentinel entry containing an intentionally invalid opcode to terminate processing. Because the sentinel was omitted, kernel code reads beyond the declared array bounds. The result is access to adjacent kernel memory regions during HCI command sequencing. The defect maps to [CWE-125] and can be reached without authentication when an attacker is within Bluetooth radio range.

Root Cause

The root cause is a missing terminator element in two initialization tables consumed by the Bluetooth HCI synchronization routines. Maintainers intended each table to end with an invalid opcode entry that the iteration loop would detect as a stop condition. Without that sentinel, the loop continues past the last valid element and reads memory that does not belong to the table. The fix introduces the missing invalid entries so the loop terminates correctly. See the kernel Bluetooth commit for the upstream patch.

Attack Vector

The attack vector is network-adjacent through the Bluetooth radio interface. An attacker triggers the vulnerable code path during HCI command processing on AMP-capable controllers. Exploitation does not require authentication or user interaction. The impact is limited to confidentiality — out-of-bounds reads may expose kernel memory contents but do not corrupt integrity or terminate the host. Refer to the Linux kernel mailing list discussion and the Bluetooth patch submission for technical analysis of the defective table iteration.

Detection Methods for CVE-2023-28866

Indicators of Compromise

Unexpected kernel log entries from the Bluetooth: hci_sync subsystem during AMP controller initialization
Abnormal HCI command sequences directed at AMP-capable adapters from untrusted peers
Kernel oops or KASAN reports referencing amp_init1 or amp_init2 symbol addresses

Detection Strategies

Inventory Linux hosts and compare running kernel versions against 6.2.8 and earlier to identify exposed assets
Enable Kernel Address Sanitizer (KASAN) builds in test environments to surface out-of-bounds reads in hci_sync.c
Monitor dmesg and journald for Bluetooth stack warnings correlated with proximity-based access

Monitoring Recommendations

Forward kernel and Bluetooth daemon logs to a centralized log platform for correlation across the fleet
Track package versions of linux-image across managed endpoints and alert on hosts that remain on pre-patch builds
Audit which production systems require the Bluetooth stack and disable the bluetooth kernel module where it is not needed

How to Mitigate CVE-2023-28866

Immediate Actions Required

Upgrade the Linux kernel to a version that includes commit 95084403f8c070ccf5d7cbe72352519c1798a40a or the equivalent distribution backport
Disable Bluetooth on servers, virtual machines, and embedded systems that do not require wireless connectivity
Restrict physical and radio-frequency proximity to sensitive hosts that cannot be patched immediately

Patch Information

The upstream fix adds the missing invalid sentinel entries to amp_init1[] and amp_init2[] in net/bluetooth/hci_sync.c. The patch is available via the Bluetooth-next git repository. Distribution vendors have shipped the change as part of standard kernel security updates. Apply vendor-provided kernel packages and reboot affected systems to load the corrected module.

Workarounds

Unload the Bluetooth kernel modules with modprobe -r bluetooth on hosts that do not need Bluetooth
Blacklist the bluetooth and btusb modules in /etc/modprobe.d/ to prevent automatic loading at boot
Remove or physically disable Bluetooth adapters on systems where the radio interface is not operationally required

bash

# Disable and blacklist the Bluetooth kernel module
sudo systemctl disable --now bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo modprobe -r btusb bluetooth