CVE-2023-51779: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability (CVE-2023-51779) was discovered in the Bluetooth subsystem of the Linux kernel through version 6.6.8. The issue exists in the bt_sock_recvmsg function within net/bluetooth/af_bluetooth.c due to a race condition with bt_sock_ioctl, leading to a use-after-free vulnerability (Linux Commit, NVD).

The vulnerability occurs when bt_sock_recvmsg() retrieves an skb (socket buffer) from sk->sk_receive_queue and frees it without holding lock_sock, creating a race condition with bt_sock_ioctl(). The specific flow that triggers the use-after-free vulnerability involves bt_sock_recvmsg() calling skb_recv_datagram() followed by skb_free_datagram(), while bt_sock_ioctl() simultaneously attempts to access the same buffer through skb_peek(). The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (High) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

The vulnerability could allow a local attacker to cause a denial of service condition through system crashes or potentially execute arbitrary code. The high CVSS score indicates potential impacts on confidentiality, integrity, and availability of the system, though exploitation is considered difficult (Red Hat).

The vulnerability requires local access and is considered difficult to exploit. While it has been rated as having a Moderate impact, it is not clear whether it could be used to achieve local privilege escalation (Red Hat).

The vulnerability has been fixed by adding lock_sock to bt_sock_recvmsg() to prevent the race condition. The fix has been implemented in various Linux distributions, including Ubuntu, Debian, and Red Hat. Users are advised to update their systems to the patched versions (Linux Commit, Ubuntu).