Linux kernel 缓冲区错误漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A slab out-of-bounds read vulnerability exists in hciextendedinquiryresultevt in net/bluetooth/hcievent.c in versions...

CVE-2020-10065

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

CVE-2020-10066

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions = v1.14.2, = v2.2.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr...

CVE-2020-10065

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

Input validation

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

In the Linux kernel before 5.12.4 net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan aka CID-5c4c8c954409. This leads to writing an arbitrary value.

...

CVE-2020-10065

CVE-2020-10065 affects Zephyr’s Bluetooth HCI over SPI. The issue is missing size checks due to improper handling of the length parameter (CWE-130) in Zephyr versions >= v1.14.2 and >= v2.2.0. The advisories reference GHSA-hg2w-62p6-g67c; no patch/affected patch version is provided in the s...

CVE-2020-10066 Incorrect Error Handling in Bluetooth HCI core

Incorrect Error Handling in Bluetooth HCI core. Zephyr versions = v1.14.2, = v2.2.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr...

CVE-2020-10065 Missing Size Checks in Bluetooth HCI over SPI

Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions = v1.14.2, = v2.2.0 contain Improper Handling of Length Parameter Inconsistency CWE-130. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62p6-g67c...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.10.37 and fixes at least the following security issues: It was discovered that the iouring implementation of the Linux kernel did not properly enforce the MAXRWCOUNT limit in some situations. A local attacker could use this to cause a denial of...

net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.

...

DEBIAN-CVE-2021-33034

In the Linux kernel before 5.12.4, net/bluetooth/hcievent.c has a use-after-free when destroying an hcichan, aka CID-5c4c8c954409. This leads to writing an arbitrary value...

Linux kernel 资源管理错误漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A post-release reuse vulnerability exists in net/bluetooth/hcievent.c in Linux kernel versions prior to 5.12.4 when...

kernel: use-after-free in drivers/bluetooth/hci_ldisc.c

A flaw was found in the Linux kernel's implementation of the HCI UART driver. A local attacker with access permissions to the Bluetooth device can issue an ioctl, which triggers the hciuartsetproto function in drivers/bluetooth/hcildisc.c. The flaw in this function can cause memory corruption or ...

USN-4592-1: Linux kernel vulnerabilities

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-12351 Andy Nguyen discovered that the...

kernel: use-after-free in drivers/bluetooth/hci_ldisc.c

A flaw was found in the Linux kernel's implementation of the HCI UART driver. A local attacker with access permissions to the Bluetooth device can issue an ioctl, which triggers the hciuartsetproto function in drivers/bluetooth/hcildisc.c. The flaw in this function can cause memory corruption or ...

Path traversal

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path...

CVE-2018-16270

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path...

PT-2019-4880 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.0.5 Description: A use-after-free issue occurs when the hci uart register dev function fails in the hci uart set proto function in the drivers/bluetooth/hci ldisc.c file. This issue may allow an attacker to...

The vulnerability of the Mac OS X operating system allows a hacker to trigger a service failure or increase their privileges.

The vulnerability of the Bluetooth HCI interface in the Mac OS X operating system is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to increase their privileges or cause a service failure memory corruption...