Linux Bluetooth Kernel Heap Buffer Overflow DoS

The vulnerability of the hcireqsyncComplete function in the Linux operating system’s Bluetooth kernel relates to the lack of releasing the previous synchronization request state before assigning a reference to the new one. Exploiting this vulnerability can allow an attacker to cause a service...

Linux kernel Bluetooth Heap Buffer Overflow DoS

The vulnerability of the l2capleflowctlinit function in the net/bluetooth/l2capcore.c module of the Linux operating system’s Bluetooth kernel implementation is related to the lack of input data validation. Exploiting this vulnerability could allow a remote attacker to cause service failures...

Linux Bluetooth Kernel L2CAP Buffer Overflow DoS

The vulnerability of the l2capconnect function in the net/bluetooth/l2capcore.c module of the Linux operating system’s Bluetooth kernel implementation is related to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an...

kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c

A flaw was found in l2capsockrelease in net/bluetooth/l2capsock.c in the Bluetooth subsystem in the Linux Kernel. This issue may allow a user to cause a use-after-free problem due to sk's children being mishandled...

Linux Bluetooth Driver Heap Buffer Overflow DoS

The vulnerability of the hciconngetPhy function in the Linux operating system’s Bluetooth driver leads to a freeze. Exploiting this vulnerability can allow an attacker to cause service failures...

SUSE CVE-2024-24860

A race condition was found in the Linux kernel's bluetooth device driver in min,maxkeysizeset function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue...

DEBIAN-CVE-2024-21803

Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM bluetooth modules allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/afbluetooth.C. This issue affects Linux kernel: fr...

Linux Bluetooth Kernel Buffer Overflow DoS

The vulnerability of the btsdioremove function in the drivers\bluetooth\btsdio.c driver of the Linux operating system’s Bluetooth kernel relates to the reutilization of previously freed memory due to a race condition. Exploiting this vulnerability could allow an attacker to cause a service failur...

DEBIAN-CVE-2023-1989

A use-after-free flaw was found in btsdioremove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdioremove with an unfinished job may cause a race problem which leads to a UAF on hdev devices...

Linux net/bluetooth/hci_conn.c Heap Buffer Overflow Privilege Escalation

The vulnerability of the hciconnhashflush function in the net/bluetooth/hciconn.c module of the Linux operating system is related to the repeated release of previously released memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

Linux Bluetooth Driver Privilege Escalation

The vulnerability of the Linux operating system’s Bluetooth driver kernel is related to errors during authentication processes. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

[SECURITY] [DSA 4951-1] bluez security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4951-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 07, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4951-1] bluez security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4951-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 07, 2021 https://www.debian.org/security/faq -...

kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan

A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in hcidisconnloglinkcompleteevt, yet stil...

Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices

Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices. According to security engineer Andy Nguyen, the...

Linux hci_uart_register_dev hci_uart_set_proto

The vulnerabilities of the functions hciuartregisterdev and hciuartsetproto drivers/bluetooth/hcildisc.c in the Linux operating system are related to the use of memory after it is freed. Exploiting these vulnerabilities could allow an attacker to compromise the confidentiality, integrity, and...

Linux Bluetooth UART DoS

The vulnerabilities in the drivers/bluetooth/hciath.c, drivers/bluetooth/hcibcm.c, drivers/bluetooth/hciintel.c, drivers/bluetooth/hcildisc.c, drivers/bluetooth/hcimrvl.c, drivers/bluetooth/hciqca.c, and drivers/bluetooth/hciuart.h files for UART-connected Bluetooth adapters in Linux operating...

Linux Bluetooth hidp_process_report Buffer Overflow

The vulnerability of the hidpprocessreport function in the Bluetooth component of the Linux kernel’s core code is due to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

BlueZ buffer overflow vulnerability (CNVD-2016-11951)

BlueZ is an official Bluetooth stack for Linux. A buffer overflow vulnerability exists in the 'setextctrl' function in the tools/parser/l2cap.c source file of BlueZ version 5.42. An attacker can exploit this vulnerability by running a compromised dump file to cause a denial of service...

Linux Kernel Information Disclosure

The vulnerability exists in the Bluetooth subsystem of the Linux kernel due to incorrect initialization of data structures. Exploiting this vulnerability allows local users to access confidential information from the kernel’s memory, using a specially crafted system call called getsockopt. This...