Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fixed an out-of-bounds read in the wacomintuosbtirq function. The wacomintuosbtirq function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fix to ensure that the LED is cleaned up when btinit fails. The btinit function calls btledsinit to register the LED. However, if this call fails later, the btledscleanup function is not called to unregister the LED...

Astra Linux – Vulnerability in bluez

The bluetoothd function from the bluez library incorrectly preserves the discoverable status of adapters when a device is powered down, and restores that status when the device is powered on again. If a device is in the discoverable state while powered down, it will remain discoverable when the...

Astra Linux – Vulnerability in Linux

A flaw involving double-free memory corruption in the Linux kernel’s HCI device initialization subsystem was discovered. This flaw allows a malicious HCI TTY Bluetooth device to be attached to the system. A local user could exploit this flaw to crash the system. This flaw affects all Linux kernel...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fixed a NULL dereferencing on non-serdev controllers during suspension. Qualcomm ROME controllers can be registered through the Bluetooth interface. In this case, the HCI UART serdev pointer is NULL. A missing...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fixed a race condition in hidpsessionthread. There is a potential race condition in hidpsessionthread that may lead to a use-after-free. For example, the timer is active while hidpdeltimer is called in hidpsessionthrea...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fixed a memory leak in vhciwrite Syzkaller reported a memory leak as follows: ==================================== BUG: Memory leak Unreferenced object 0xffff88810d81ac00 size 240: ... Hex dump first 32 bytes: 0...

Astra Linux – Vulnerability in Linux 5.15

A vulnerability has been identified in the Linux kernel and is classified as problematic. This vulnerability affects the function l2caprecvacldata in the file net/bluetooth/l2capcore.c of the Bluetooth component. The vulnerability causes a memory leak. It is recommended that a patch be applied to...

kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

A flaw was found in the Linux kernel's Bluetooth subsystem. Improper handling of locking within the hciconnrequestevt function, particularly when the HCIPROTODEFER protocol is active, can result in a Use-After-Free UAF vulnerability. This condition arises when a connection object is accessed afte...

kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A race condition exists where the isosockcleartimer function can access connection data without proper locking, while another function, isoconndel, concurrently modifies the same data. This can lead to a NULL point...

kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report()

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP. A remote attacker, by sending specially crafted truncated packets from a paired Bluetooth device, could trigger an out-of-bounds read in the hidpinputreport function. This vulnerability may lead to unintended...

kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

kernel: Bluetooth: serialize accept_q access

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition exists in the handling of the acceptq within the btsockpoll function due to a lack of synchronization. This could allow a local attacker to cause a denial of service by manipulating socket operations during child teardow...

kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

A flaw was found in the Bluetooth subsystem of the Linux kernel, specifically within the hcisync component. This vulnerability occurs when the hciadvbcastannoucement function attempts to prepend Broadcast Announcement service data to an existing advertising payload that is already at its maximum...

kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel MCC frames. This lack of proper validation of incoming data length befor...

kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...

kernel: Bluetooth: ISO: fix UAF in iso_recv_frame

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. This vulnerability, known as a Use-After-Free, occurs because the system attempts to use a memory area after it has been released, which can lead to unpredictable behavior. A malicious actor could potentially explo...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, allows an attacker to access memory after it has been freed. This can lead to a system crash, resulting in a Denial of Service DoS, or potentially enable an attacker to execute malicious code. Th...

kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response

A flaw was found in the Linux kernel's Bluetooth Security Manager Protocol SMP. An attacker could exploit this vulnerability during the Bluetooth pairing process by manipulating authentication requirements. This could lead to the selection of a weaker pairing method than intended, potentially...