CVE-2023-2002 is a vulnerability found in the HCI sockets implementation of the Linux Kernel, which allows attackers to execute unauthorized management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. With a severity rating of 6.8 MEDIUM, this vulnerability affects the Linux Kernel and specific versions of Debian Linux. Systems running the Linux Kernel up to (excluding) version 6.4 and Debian Linux versions 10.0 and 11.0 are at risk. This means that certain systems using Linux and Debian Linux are susceptible to unauthorized access and potential data leaks or disruptions in Bluetooth communication.

How do I know if I'm affected?

If you're using Linux Kernel up to (excluding) version 6.4 or Debian Linux versions 10.0 and 11.0, you may be affected by the vulnerability. This issue can compromise the confidentiality, integrity, and availability of Bluetooth communication on your system. To determine if you're affected, check your system's Linux Kernel or Debian Linux version. This vulnerability doesn't impact Apple products or other operating systems.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action. First, upgrade your Linux packages to the latest version. For Debian 10 users, upgrade to version 4.19.289-1, and for Linux-5.10 users, upgrade to version 5.10.197-1~deb10u1. Keep an eye on security advisories for software fixes and apply them as they become available. If you need assistance, contact your system's technical support.

Is CVE-2023-2002 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-2002 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, found in the HCI sockets implementation of the Linux Kernel, allows attackers to execute unauthorized management commands, compromising Bluetooth communication. It's important to upgrade your Linux packages to the latest version to mitigate this vulnerability and maintain the security of your system.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-863 and CWE-250, which includes two main issues: incorrect authorization and execution with unnecessary privileges. These weaknesses can lead to unauthorized access, data leaks, and disruptions in system communication.

For more details

CVE-2023-2002 is a notable vulnerability affecting the Linux Kernel and specific Debian Linux versions, with potential consequences such as unauthorized access, data leaks, and disruptions in Bluetooth communication. To gain a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below for more information.

• NVD - CVE-2023-2002

• Debian LTS Advisory DLA 3508-1

• Debian LTS Advisory DLA 3623-1 (1)

• NetApp Product Security Advisory

• Debian Security Advisory DSA 5480-1