Double free

Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer...

zephyr 资源管理错误漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in zephyr 3.2 and earlier versions, which stems from inconsistent handling of error conditions in bluetooth hci, and could lead to a double release of a network buffer...

PT-2023-13577 · Unknown · Bluetooth Hci

Name of the Vulnerable Software and Affected Versions: Bluetooth HCI affected versions not specified Description: The issue is related to inconsistent handling of error cases in Bluetooth HCI, which may lead to a double free condition of a network buffer. Recommendations: At the moment, there is ...

CVE-2023-0396 Buffer Overreads in Bluetooth HCI

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...

USN-5780-1: Linux kernel (OEM) vulnerabilities

It was discovered that a memory leak existed in the IPv6 implementation of the Linux kernel. A local attacker could use this to cause a denial of service memory exhaustion. CVE-2022-3524 It was discovered that the Bluetooth HCI implementation in the Linux kernel did not properly deallocate memory...

PT-2022-35287 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to the Bluetooth hci sysfs in the Linux Kernel, where an attempt to call device add multiple times could potentially lead to a security vulnerability. The actual impact...

PT-2022-35494 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to the Bluetooth hci sysfs in the Linux Kernel, where an attempt to call device add multiple times could potentially lead to a security vulnerability. The actual impac...

PT-2022-35830 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.296 Description: The issue is related to the Bluetooth hci sysfs in the Linux Kernel. It involves attempting to call device add multiple times. The actual impact and attack plausibility have not yet been...

PT-2022-35897 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.331 Description: The issue is related to the Bluetooth hci sysfs in the Linux Kernel, where an attempt to call device add multiple times could potentially lead to security vulnerabilities. The actual impact...

USN-5299-1: Linux kernel vulnerabilities

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. CVE-2020-26147 It was discovered that the bluetooth...

Buffer overflow in the Bluetooth HCI_ISO dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file

...

kernel: race condition for removal of the HCI controller

A flaw was found in the Linux kernel’s handling of the removal of Bluetooth HCI controllers. This flaw allows an attacker with a local account to exploit a race condition, leading to corrupted memory and possible privilege escalation. The highest threat from this vulnerability is to...

CVE-2021-1007

In btuhcifprocessevent of btuhcif.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID:...

kernel: race condition for removal of the HCI controller

A flaw was found in the Linux kernel’s handling of the removal of Bluetooth HCI controllers. This flaw allows an attacker with a local account to exploit a race condition, leading to corrupted memory and possible privilege escalation. The highest threat from this vulnerability is to...

The vulnerability of the hci_chan structure in the net/bluetooth/hci_event.c component of the Linux operating system allows a attacker to execute arbitrary code.

The vulnerability of the hcichan structure in the net/bluetooth/hcievent.c component of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

kernel: race condition for removal of the HCI controller

A flaw was found in the Linux kernel’s handling of the removal of Bluetooth HCI controllers. This flaw allows an attacker with a local account to exploit a race condition, leading to corrupted memory and possible privilege escalation. The highest threat from this vulnerability is to...

kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan

A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in hcidisconnloglinkcompleteevt, yet stil...

USN-5016-1 linux, linux-aws, linux-aws-5.8, linux-azure, linux-azure-5.8, linux-gcp, linux-gcp-5.8, linux-hwe-5.8, linux-kvm, linux-oracle, linux-oracle-5.8, linux-raspi vulnerabilities

It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A local attacker could use this to cause a denial of service system crash or execute arbitrary code. CVE-2021-33909 Or Cohen and Nadav Markus discovered a...

kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan

A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in hcidisconnloglinkcompleteevt, yet stil...

Important: kernel-livepatch-4.14.231-173.361

Issue Overview: A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in...