CVE-2020-0023

CVE-2020-0022 Android 9-6은 유사한 Bluetooth 서브시스템을 가지고 있는 것으로 보이며, Android 5와 4는 다릅니다. Android 9.0 BlueFrag 실험 패치: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf 아래에서 패치 조건을 충족시켰습니다. 좋습니다, 이해한 것 같지만 어떻게든 프로세스를 충돌시킬 수 없습니다. hmmmm 사실, 서명된 길이 값을 memcpy에...

CVE-2026-80764

CVE-2026-80764 affects the Linux kernel Bluetooth subsystem. The vulnerability is a use-after-free (UAF) in the HCI event handler: hci_cc_reset() clears the LE accept and resolving lists without acquiring hdev->lock , while debugfs readers (e.g., white_list_show) hold that lock while traversin...

EUVD-2026-71407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...

CVE-2026-80763

CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...

EUVD-2026-71406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80762

CVE-2026-80762 is a use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync). The function hci_update_event_filter_sync() walks the device's accept list while issuing synchronous HCI commands per remote-wakeup device. The suspend path holds hdev->req_lock, but accept-list mutation...

CVE-2026-80760

CVE-2026-80760 affects the Linux kernel Bluetooth MGMT subsystem. The function mgmt_hci_cmd_sync() validates that the message length matches params_len but fails to enforce an upper bound. Since params_len is a 16-bit value while the HCI command header plen field is 8-bit (max 255), a value of 25...

BLE-Replay

BLE-Replay BLE-Replay — это инструмент для оценки периферийных устройств Bluetooth Low Energy BLE. Он получает HCI-логи Bluetooth с вашего мобильного устройства и извлекает из них все операции записи, которые центральное устройство выполняет в адрес периферийного устройства. Эти данные можно...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...

CVE-2023-2002

Linux Bluetooth: неавторизованное выполнение управляющих команд CVE-2023-2002 В подсистеме Bluetooth ядра Linux обнаружена недостаточная проверка прав при обработке системных вызовов ioctl для сокетов HCI. Из-за этого задачи без надлежащей возможности CAPNETADMIN могут легко помечать сокеты HCI к...

CVE-2025-27840-WIP

CVE-2025-27840-WIP CVE-2025-27840에 대한 작업 진행 중WIP 자료 CVE-2025-27840 개요 CVE-2025-27840 은 전 세계 10억 개 이상의 IoT 기기에 통합된 Espressif ESP32 Bluetooth 칩 에 영향을 미치는 중간 심각도 취약점CVSS 6.8입니다. 이 결함은 문서화되지 않은 29개의 HCIHost Controller Interface 명령 과 관련되어 있으며, 이를 통해 승인되지 않은 메모리 접근 및 기기 제어가 가능할 수 있습니다. 🔧 주요 기술 세부 사항...

esp32-cve-2025-27840-power-trace-experiment

esp32-cve-2025-27840-power-trace-experiment ESP32가 문서화되지 않은 hci 블루투스 명령CVE-2025-27840을 수신할 때 블루투스 모듈의 동작에 대한 전력 트레이스를 얻기 위한 펌웨어입니다. ESP32가 명령을 수신하면 GPIO 핀을 토글하여 전력 트레이스 캡처를 트리거합니다. 블루투스 컨트롤러 태스크가 스케줄될 때 이를 수행하려면 트레이스 훅trace hook을 사용하는 것을 권장합니다. 트리거 메커니즘은 trigger-mechanisms 폴더에서 확인할 수 있습니다. 이 코드는...

CVE-2025-27840-WIP

CVE-2025-27840-WIP CVE-2025-27840를 위한 작업 진행 중WIP 자료 CVE-2025-27840 개요 CVE-2025-27840 은 전 세계 10억 개 이상의 IoT 기기에 통합된 Espressif ESP32 Bluetooth 칩 에 영향을 미치는 중간 심각도 취약점CVSS 6.8입니다. 이 결함은 승인되지 않은 메모리 액세스와 장치 제어를 가능하게 할 수 있는 29개의 문서화되지 않은 HCIHost Controller Interface 명령 과 관련됩니다. 🔧 주요 기술 세부 사항 ESP32 펌웨어 버...

SUSE CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

UBUNTU-CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80692 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

EUVD-2026-67427

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80692 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80692

CVE-2026-80692 is a theoretical Use-After-Free (UAF) in the Linux kernel's Bluetooth HCI subsystem , specifically in the hci_connect_acl() and hci_connect_le_sync() callbacks. If the conn object is freed while the hci_sync task is running, a UAF can occur. The fix holds a refcount to the conn obj...