CVE-2024-33052

Memory corruption when user provides data for FM HCI command control operations...

DEBIAN-CVE-2024-53207

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible deadlocks This fixes possible deadlocks like the following caused by hcicmdsyncdequeue causing the destroy function to run: INFO: task kworker/u19:0:143 blocked for more than 120 seconds. Tainted: G ...

SUSE CVE-2024-50255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hcireadsupportedcodecs Fix hcicmdsyncsk to return not NULL for unknown opcodes. hcicmdsyncsk returns NULL if a command returns a status event. However, it also returns NULL where an opcode...

CVE-2024-33052

Memory corruption when user provides data for FM HCI command control operations...

CVE-2024-33052 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when user provides data for FM HCI command control operations...

CVE-2024-33052

CVE-2024-33052 describes a memory corruption in the FM Host/HCI control path when data is provided for FM HCI commands. The vulnerability is tied to Qualcomm chipsets and is classified as local with low privileges and no user interaction, and the impact is rated high (confidentiality, integrity, ...

CVE-2024-33052 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when user provides data for FM HCI command control operations...

PT-2024-25095 · Qualcomm · 205 Mobile Firmware +228

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption when a user provides data for FM HCI command control operations. This can potentially lead to security risks. The...

SUSE CVE-2024-35933

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintelreadversion If hcicmdsynccomplete is triggered and skb is NULL, then hdev-reqskb is NULL, which will cause this issue...

UBUNTU-CVE-2024-35933

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintelreadversion If hcicmdsynccomplete is triggered and skb is NULL, then hdev-reqskb is NULL, which will cause this issue...

kernel: Bluetooth: Fix race condition in hci_cmd_sync_clear

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hcicmdsyncclear There is a potential race condition in hcicmdsyncwork and hcicmdsyncclear, and could lead to use-after-free. For instance, hcicmdsyncwork is added to the 'reqworkqueue' after...

PT-2024-21758 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: In the sendHciCommand function of bluetooth hci.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System...

Design/Logic Flaw

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...

PT-2023-16239 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth software affected versions not specified Description: A malicious or defective Bluetooth controller can cause buffer overreads in most functions that process HCI command responses. Recommendations: At the moment, there is no...

CVE-2023-0396 Buffer Overreads in Bluetooth HCI

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...

CVE-2023-0396

CVE-2023-0396 describes a buffer overread in the Bluetooth controller’s handling of HCI command responses. The root cause is a malformed/defective Bluetooth controller causing overreads across many functions that process HCI responses. Documents consistently reference high impact on confidentiali...

PT-2025-26092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel's Bluetooth functionality has been identified. When the HCI work queue is drained, only queue chained work is allowed, but another delayed work can...

Command injection

Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...

CVE-2018-19860

Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...

CVE-2018-19860

CVE-2018-19860 affects Broadcom Bluetooth firmware (Nexus 5 BCM4335C0; Raspberry Pi 3 BCM43438A1; other Broadcom-based devices) prior to summer 2014. The issue is an improper restriction of LMP commands, allowing an LMP command to cause execution of memory contents, effectively enabling memory co...