In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciconn: fail SCO/ISO via hciconn_failed if ACL gone early
Not calling hci(dis)connectcfm before deleting conn referred to by a socket generally results to use-after-free.
When cleaning up SCO connections when the parent ACL is deleted too early, use hciconnfailed to do the connection cleanup properly.
We also need to clean up ISO connections in a similar situation when connecting has started but LE Create CIS is not yet sent, so do it too here.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e94b898463a62b72a2a8b75dea8936bf4db78e00",
"target": {
"function": "hci_conn_unlink",
"file": "net/bluetooth/hci_conn.c"
},
"digest": {
"function_hash": "179336643241077742732712737028875774212",
"length": 682.0
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53374-30fc0ae1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3344d318337d9dca928fd448e966557ec5063f85",
"target": {
"file": "net/bluetooth/hci_conn.c"
},
"digest": {
"line_hashes": [
"95967537183008994531407961392780913088",
"210116737686708540573196162878134629891",
"119127045094749826033625683927643726146",
"111476707994198539655253268552197779524",
"257642914838037097200325854256206426484",
"38312414395489856843837330208772512099",
"133574481573426461902194697919070630350",
"112196061015423429826255257412328620910",
"123855321875702328078799890700694960892",
"175593653502426615670854972367914462616"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53374-34ec0a69",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3344d318337d9dca928fd448e966557ec5063f85",
"target": {
"function": "hci_conn_unlink",
"file": "net/bluetooth/hci_conn.c"
},
"digest": {
"function_hash": "179336643241077742732712737028875774212",
"length": 682.0
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53374-3917315e",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@397d58007532644b35fad746da48c41161f32a57",
"target": {
"function": "hci_conn_unlink",
"file": "net/bluetooth/hci_conn.c"
},
"digest": {
"function_hash": "179336643241077742732712737028875774212",
"length": 682.0
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53374-4d7c7418",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@397d58007532644b35fad746da48c41161f32a57",
"target": {
"file": "net/bluetooth/hci_conn.c"
},
"digest": {
"line_hashes": [
"95967537183008994531407961392780913088",
"210116737686708540573196162878134629891",
"119127045094749826033625683927643726146",
"111476707994198539655253268552197779524",
"257642914838037097200325854256206426484",
"38312414395489856843837330208772512099",
"133574481573426461902194697919070630350",
"112196061015423429826255257412328620910",
"123855321875702328078799890700694960892",
"175593653502426615670854972367914462616"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53374-5cd0d4fc",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e94b898463a62b72a2a8b75dea8936bf4db78e00",
"target": {
"file": "net/bluetooth/hci_conn.c"
},
"digest": {
"line_hashes": [
"95967537183008994531407961392780913088",
"210116737686708540573196162878134629891",
"119127045094749826033625683927643726146",
"111476707994198539655253268552197779524",
"257642914838037097200325854256206426484",
"38312414395489856843837330208772512099",
"133574481573426461902194697919070630350",
"112196061015423429826255257412328620910",
"123855321875702328078799890700694960892",
"175593653502426615670854972367914462616"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53374-c7ffabf6",
"signature_type": "Line"
}
]