HCI send_sync Dangling Semaphore Reference Re-use

CVE-2023-1901

What is CVE-2023-1901?

A vulnerability in the Bluetooth HCI host layer within the Zephyr Project arises from improper clearing of a global reference to a semaphore after HCI commands are sent. This flaw can be exploited by a malicious HCI controller, potentially leading to the use of a dangling reference within the host layer. Such exploitation can result in a denial-of-service condition or even facilitate remote code execution, posing significant risks to the affected systems.

References