CVE-2023-53673

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: call disconnect callback before deleting conn

In hci_cs_disconnect, we do hci_conn_del even if disconnection failed.

ISO, L2CAP and SCO connections refer to the hci_conn without

hci_conn_get, so disconn_cfm must be called so they can clean up their

conn, otherwise use-after-free occurs.

ISO:

==========================================================

iso_sock_connect:880: sk 00000000eabd6557

iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da

...

iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073

hci_dev_put:1487: hci0 orig refcnt 17

__iso_chan_add:214: conn 00000000b6251073

iso_sock_clear_timer:117: sock 00000000eabd6557 state 3

...

hci_rx_work:4085: hci0 Event packet

hci_event_packet:7601: hci0: event 0x0f

hci_cmd_status_evt:4346: hci0: opcode 0x0406

hci_cs_disconnect:2760: hci0: status 0x0c

hci_sent_cmd_data:3107: hci0 opcode 0x0406

hci_conn_del:1151: hci0 hcon 00000000169

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References