UBUNTU-CVE-2020-36386

An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hcievent.c has a slab out-of-bounds read in hciextendedinquiryresultevt, aka CID-51c19bf3d5cf...

Linux kernel 缓冲区错误漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A slab out-of-bounds read vulnerability exists in hciextendedinquiryresultevt in net/bluetooth/hcievent.c in versions...

UBUNTU-CVE-2021-3573

A use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

CVE-2021-3573

A use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.10.41 and fixes at least the following security issues: A double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash...

PT-2021-4240 · Linux +8 · Linux Kernel +8

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.13-rc5 Description: A use-after-free in the function hci sock bound ioctl of the Linux kernel HCI subsystem was found. This occurs when a user calls ioct HCIUNBLOCKADDR or triggers a race condition with the ca...

CVE-2020-10065

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

CVE-2020-10066

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions = v1.14.2, = v2.2.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr...

CVE-2020-10065

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

Input validation

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

CVE-2021-3564

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. Mitigation Mitigation for this issue is either not available or the currently...

In the Linux kernel before 5.12.4 net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan aka CID-5c4c8c954409. This leads to writing an arbitrary value.

...

CVE-2020-10065 Missing Size Checks in Bluetooth HCI over SPI

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

CVE-2020-10065

CVE-2020-10065 affects Zephyr’s Bluetooth HCI over SPI. The issue is missing size checks due to improper handling of the length parameter (CWE-130) in Zephyr versions >= v1.14.2 and >= v2.2.0. The advisories reference GHSA-hg2w-62p6-g67c; no patch/affected patch version is provided in the s...

CVE-2020-10066 Incorrect Error Handling in Bluetooth HCI core

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions = v1.14.2, = v2.2.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.10.37 and fixes at least the following security issues: It was discovered that the iouring implementation of the Linux kernel did not properly enforce the MAXRWCOUNT limit in some situations. A local attacker could use this to cause a denial of...

CVE-2021-33034

A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in hcidisconnloglinkcompleteevt, yet stil...

PT-2021-4254 · Linux +8 · Linux Kernel +8

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.13 and later Description: A double-free memory corruption flaw was found in the Linux kernel's HCI device initialization subsystem. This issue arises when a user attaches a malicious HCI TTY Bluetooth device. A local...

net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.

...

DEBIAN-CVE-2021-33034

In the Linux kernel before 5.12.4, net/bluetooth/hcievent.c has a use-after-free when destroying an hcichan, aka CID-5c4c8c954409. This leads to writing an arbitrary value...