In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciconn: return ERRPTR instead of NULL when there is no link
hciconnectsco currently returns NULL when there is no link (i.e. when hciconnlink() returns NULL).
scoconnect() expects an ERRPTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to scoconnadd(), which tries to get hcon->hdev, resulting in dereferencing a NULL pointer as reported by syzkaller.
The same issue exists for isoconnectcis() calling hciconnectcis().
Thus, make hciconnectsco() and hciconnectcis() return ERR_PTR instead of NULL.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54038.json"
}