CVE-2023-51779: Linux Kernel Bluetooth Use-After-Free

CVE-2023-51779 Overview

CVE-2023-51779 is a use-after-free vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in bt_sock_recvmsg within net/bluetooth/af_bluetooth.c and affects the Linux kernel through version 6.6.8. A race condition between bt_sock_recvmsg and bt_sock_ioctl allows concurrent access to a socket buffer that one thread has already freed. A local attacker with low privileges can trigger the race to corrupt kernel memory, leading to privilege escalation or kernel panic. The weakness is classified as [CWE-416] Use After Free.

Critical Impact
Local attackers can exploit the race condition in the Bluetooth socket layer to achieve kernel memory corruption, with potential for privilege escalation to root on affected Linux systems.

Affected Products

Linux kernel versions through 6.6.8
Distributions shipping the vulnerable Bluetooth subsystem, including Debian (addressed via Debian LTS)
Any system with the Bluetooth stack compiled and accessible to local users

Discovery Timeline

2024-02-29 - CVE-2023-51779 published to the National Vulnerability Database (NVD)
2024-06 - Debian LTS issues a security announcement addressing the vulnerability
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2023-51779

Vulnerability Analysis

The vulnerability stems from missing socket-level locking in the Bluetooth receive path. The bt_sock_recvmsg function calls skb_recv_datagram to dequeue a socket buffer (skb) without holding the socket lock. Concurrently, bt_sock_ioctl can manipulate the same socket's receive queue. This creates a window where one thread frees an skb while another retains a reference, producing a use-after-free condition. Successful exploitation requires the attacker to win a narrow timing race between two kernel paths operating on the same Bluetooth socket.

Root Cause

The receive path did not acquire lock_sock(sk) before dequeuing data. Without the socket lock, bt_sock_ioctl running on another CPU can mutate state that bt_sock_recvmsg assumes is stable. The kernel reaches code paths that operate on a freed skb, corrupting the slab allocator's metadata or producing dangling pointers usable for further memory corruption.

Attack Vector

Exploitation requires local access and the ability to open a Bluetooth socket (AF_BLUETOOTH). The attacker spawns multiple threads: one repeatedly invokes recvmsg() and another issues ioctl() calls on the same socket file descriptor. By tuning thread timing, the attacker triggers the race and reclaims the freed skb slab object with attacker-controlled data, enabling kernel memory corruption.

// Patch from upstream Linux kernel - adds socket locking to bt_sock_recvmsg
 	if (flags & MSG_OOB)
 		return -EOPNOTSUPP;
 
+	lock_sock(sk);
+
 	skb = skb_recv_datagram(sk, flags, &err);
 	if (!skb) {
 		if (sk->sk_shutdown & RCV_SHUTDOWN)
-			return 0;
+			err = 0;
 
+		release_sock(sk);
 		return err;
 	}

Source: Linux kernel commit 2e07e8348ea4 — the patch wraps the receive path in lock_sock()/release_sock() to serialize access against bt_sock_ioctl and close the race window.

Detection Methods for CVE-2023-51779

Indicators of Compromise

Unexpected kernel oops or panic messages referencing bt_sock_recvmsg, skb_recv_datagram, or slab corruption in dmesg and /var/log/kern.log
KASAN reports indicating use-after-free reads or writes in the Bluetooth subsystem
Unprivileged processes opening AF_BLUETOOTH sockets and issuing high-frequency recvmsg/ioctl syscall pairs against the same file descriptor

Detection Strategies

Audit auditd or eBPF telemetry for processes that create AF_BLUETOOTH (family 31) sockets and rapidly alternate between recvmsg and ioctl syscalls
Enable kernel KASAN on test systems to surface use-after-free conditions in the Bluetooth stack before production exploitation
Inventory running kernel versions with uname -r and flag hosts running Linux 6.6.8 or earlier without the upstream Bluetooth patch

Monitoring Recommendations

Forward kernel ring buffer events to a centralized SIEM and alert on oops or BUG messages mentioning bluetooth or af_bluetooth
Monitor for unprivileged users loading the bluetooth kernel module or accessing /dev/rfkill and Bluetooth socket interfaces on servers that do not require Bluetooth
Track local privilege escalation telemetry such as unexpected UID transitions following Bluetooth subsystem activity

How to Mitigate CVE-2023-51779

Immediate Actions Required

Update the Linux kernel to a version containing commit 2e07e8348ea4 or apply the vendor backport for your distribution
For Debian systems, apply the update referenced in the Debian LTS announcement
Restrict local shell access on multi-user systems until patches are deployed, since exploitation requires local privileges

Patch Information

The upstream fix is available in the Linux kernel commit 2e07e8348ea4, titled "Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg." The patch adds lock_sock(sk) and matching release_sock(sk) calls around the receive datagram path, serializing the socket against concurrent bt_sock_ioctl operations. Distribution backports are available from Debian LTS and other downstream maintainers.

Workarounds

Blacklist the bluetooth kernel module on systems that do not require Bluetooth functionality by adding blacklist bluetooth to /etc/modprobe.d/
Remove or disable the bluetooth.service systemd unit on servers and headless infrastructure to reduce attack surface
Restrict access to Bluetooth sockets using AppArmor, SELinux, or seccomp profiles that block the AF_BLUETOOTH socket family for untrusted users

bash

# Disable the Bluetooth kernel module to mitigate exposure on systems that do not need it
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo modprobe -r btusb bluetooth

# Verify the module is no longer loaded
lsmod | grep -i bluetooth