CVE-2023-53016

Summary

CVE-2023-53016 is a recently identified vulnerability in the Linux kernel that could lead to a deadlock in the Bluetooth subsystem [1]. The issue lies in the interaction between the socket (sk) lock and the rfcomm lock in the functions rfcomm_sock_connect and rfcomm_sock_release. Specifically, when rfcomm_sock_connect attempts to acquire the sk lock while the rfcomm lock is held by rfcomm_sock_release, a deadlock can occur. This has been resolved by releasing the sk lock before calling rfcomm_dlc_open in the former function, and holding a reference to sk's in the latter to prevent use-after-free. [1] syzbot (2023). CVE-2023-53016: Deadlock in rfcomm_sk_state_change. Retrieved from <https://syz.io/vuln/CVE-2023-53016>.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.