CVE-2023-1902

CVE-2023-1902 is a high-severity vulnerability affecting the Bluetooth HCI host layer in Zephyr Project's Zephyr operating system. It stems from the host layer failing to clear a global reference to a state pointer after connection events, allowing a malicious HCI Controller to induce a use-after-free condition. This can lead to a denial-of-service (DoS) crash or potentially remote code execution (RCE) on the host. The attack requires adjacent network access and low privileges, but no user interaction. There is currently no public exploit code, active exploitation, or significant community discussion surrounding this vulnerability.