CVE-2023-7356: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-7356 is a tampering vulnerability in the Linux kernel's Bluetooth ISO implementation, where Periodic Advertisement Reports are copied to the BASE (Broadcast Audio Source Endpoint) structure without validating that the service UUID matches the Basic Audio Announcement Service UUID (EIR_BAA_SERVICE_UUID). This allows arbitrary service data to be incorrectly processed and stored as valid BASE information. Affected Linux kernel versions are those prior to 6.1.178 (in the 6.1 series) and prior to 6.6.145 (in the 6.6 series); kernel 6.7 and later are unaffected. The CVSS base score is currently listed as 0.0 (unscored/medium estimate) (GitHub Advisory, Feedly).

The root cause is improper input validation (missing UUID check) in the Bluetooth ISO subsystem of the Linux kernel. When a Periodic Advertisement Report is received, the kernel copies its content to the BASE structure without first verifying that the service UUID in the report matches EIR_BAA_SERVICE_UUID (Basic Audio Announcement Service UUID). The fix ensures the copy operation only occurs when the UUID matches, preventing malformed or malicious service data from being processed as valid audio announcement data. The attack vector requires Bluetooth proximity (physical adjacency), and no authentication is needed — an attacker within Bluetooth range can send a crafted Periodic Advertisement Report to trigger the flaw (GitHub Advisory, Feedly).

An unauthenticated attacker within Bluetooth proximity can send a crafted Periodic Advertisement Report that is incorrectly copied to the BASE structure, potentially causing the kernel to process malformed or malicious audio announcement data. The primary risks are denial of service (kernel instability or crash) and data corruption within the Bluetooth ISO subsystem. There is no evidence of remote code execution capability or lateral movement potential associated with this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires physical Bluetooth proximity, which significantly limits the attacker pool (GitHub Advisory, Feedly).

Update the Linux kernel to version 6.1.178 or later (for the 6.1 stable series) or 6.6.145 or later (for the 6.6 stable series); kernel 6.7 and later are unaffected by default. The fixes are available via the upstream stable kernel commits: ba25efe, 927ef40, and f4da3ee. As a workaround, restrict Bluetooth device discovery to trusted environments or disable Bluetooth ISO functionality if it is not required (GitHub Advisory, Feedly).