bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability

A flaw was found within the handling of the Phone Book Access profile in BlueZ. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a...

bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability

A flaw was found within the handling of the AVRCP protocol in BlueZ. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect ...

bluez: AVRCP stack-based buffer overflow remote code execution vulnerability

A flaw was found within the handling of the AVRCP protocol in BlueZ. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a...

bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability

A flaw was found within the handling of the Phone Book Access profile in BlueZ. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a...

Moderate: Red Hat Security Advisory: bluez security update

An update for bluez is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

kernel: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcommchecksecurity The Linux kernel CVE team has assigned CVE-2024-26903 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041745-CVE-2024-26903-de5c@gregkh...

kernel: Bluetooth: hci_core: Fix possible buffer overflow

A buffer overflow flaw was found in struct hcidevinfo in the variable name8 in the Linkkux Kernel. If an attacker crafts an exploit copying more than the size of the name8, it results in a buffer overflow and a denial of service...

kernel: Bluetooth: btrtl: fix out of bounds memory access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtekdata'. If btrtl driver is used with btusb, then memory for private hci data is...

kernel: Bluetooth: ISO: Check socket flag instead of hcon

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Check socket flag instead of hcon This fixes the following Smatch static checker warning: net/bluetooth/iso.c:1364 isosockrecvmsg error: we previously assumed 'pi-conn-hcon' could be null line 1359...

kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set()

A race condition was found in the Linux kernel's net/bluetooth device driver within the conninfomin,maxageset function. This issue can lead to an integrity overflow issue, potentially disrupting Bluetooth connections or facilitating a denial of service attack...

kernel: bluetooth: race condition in sniff_{min,max}_interval_set()

A race condition vulnerability was found in the Linux kernel's net/bluetooth in sniffmin,maxintervalset function. This issue can result in a Bluetooth sniffing exception issue, possibly leading to denial of service...

kernel: Bluetooth: hci_core: cancel all works upon hci_unregister_dev()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: cancel all works upon hciunregisterdev syzbot is reporting that calling hcireleasedev from hcierrorreset due to hcidevput from hcierrorreset can cause deadlock at destroyworkqueue, for hcierrorreset is called...

kernel: NULL Pointer dereference bluetooth allows Overflow Buffers

A NULL pointer dereference vulnerability was found in the Linux kernel in rfcommchecksecurity. This issue may lead to buffer overflows...

kernel: net/bluetooth: race condition in {conn,adv}_{min,max}_interval_set() function

A race condition flaw was found in the Linux kernel's net/bluetooth, specifically in the conn,advmin,maxintervalset function, which may disrupt I2cap connections, possibly causing a denial of service. This flaw allows an attacker to disrupt Bluetooth connections, leading to a potential denial of...

kernel: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX

A warning was observed in the Linux kernel in hciconndel caused by freeing handle that was not allocated using ida allocator. This is caused by handle bigger than HCICONNHANDLEMAX passed by hcilebigsyncestablishedevt, which makes code think it's unset connection...

kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS)

A flaw was discovered in the Bluetooth protocol affecting the Bluetooth BR/EDR authentication. An attacker with physical access to the Bluetooth connection could perform a spoofing attack impersonating the address of a previously paired remote device. This attack may result in the attacking devic...

kernel: Bluetooth: btusb: Add date->evt_skb is NULL check

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Add date-evtskb is NULL check fix crash because of null pointers 6104.969662 BUG: kernel NULL pointer dereference, address: 00000000000000c8 6104.969667 PF: supervisor read access in kernel mode 6104.969668 PF:...

Bluetooth: L2CAP: Fix uaf in l2cap_connect

...

OPENSUSE-SU-2024:14486-1 switchboard-plug-bluetooth-8.0.1-1.1 on GA media

These are all security issues fixed in the switchboard-plug-bluetooth-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

Intel® PROSet/Wireless Wi-Fi Software and Intel® Wireless Bluetooth Advisory

Summary: Potential security vulnerabilities in some Intel® PROSet/Wireless Software, Intel® Killer™ Wi-Fi and Intel® Wireless Bluetooth® may allow denial of service or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details:...