Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2024-10677 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue is related to a possible out of bounds write in the handle notification response function of btif rc.cc due to a missing bounds check. This could lead to remote code execution...

ChargePoint Home Flex 信息泄露漏洞

ChargePoint Home Flex is a series of electric vehicle charging devices from ChargePoint USA. An information disclosure vulnerability exists in the ChargePoint Home Flex, which stems from a Bluetooth low-power information disclosure in the Wi-Fi setup logic, which could lead to a network-adjacent...

CVE-2018-9485

In l2cbleprocesssigcmd of l2cble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2018-9484

In l2cusendpeerconfigrej of l2cutils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-36898

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the Bluetooth component, specifically in the hci conn module. The fix involves using disable delayed work...

BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

A vulnerability was found in the BlueZ Audio Profile AVRCP, stemming from the improper validation of array indices. This flaw resides in the AVRCP protocol handling and arises due to inadequate validation of user-supplied data. Consequently, it may lead to writing beyond the bounds of an allocate...

bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability

A flaw was found within the handling of the AVRCP protocol in BlueZ. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect ...

bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability

A flaw was found within the handling of the Phone Book Access profile in BlueZ. In certain conditions, a network-adjacent attacker can execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicio...

kernel: NULL Pointer dereference bluetooth allows Overflow Buffers

A NULL pointer dereference vulnerability was found in the Linux kernel in rfcommchecksecurity. This issue may lead to buffer overflows...

CVE-2020-10370

Certain Cypress and Broadcom Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a "Spectra" attack...

CVE-2024-50255 Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hcireadsupportedcodecs Fix hcicmdsyncsk to return not NULL for unknown opcodes. hcicmdsyncsk returns NULL if a command returns a status event. However, it also returns NULL where an opcode...

CVE-2024-50148 Bluetooth: bnep: fix wild-memory-access in proto_unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in protounregister There's issue as follows: KASAN: maybe wild-memory-access in range 0xdead...108-0xdead...10f CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G W RIP:...

The vulnerability of the hci_enhanced_setup_sync() function in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hcienhancedsetupsync function in the net/bluetooth/hciconn.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2024-50124 Bluetooth: ISO: Fix UAF on iso_sock_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on isosocktimeout conn-sk maybe have been unlinked/freed while waiting for isoconnlock so this checks if the conn-sk is still valid by checking if it part of isosklist...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure of the Bluetooth: ISO module to properly handle connection pointers in the isosocktimeout function...

PT-2024-8528

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.61 Description The issue is related to a use-after-free vulnerability in the sco sock timeout function in the Linux kernel's Bluetooth implementation. This vulnerability may allow an attacker to impact the...

CVE-2022-48971

A denial of service panic vulnerability was found in the Linux kernel's Bluetooth subsystem. When the btinit function call fails, btledscleanup is not called to unregister it, which can lead to a panic, resulting in the system's loss of availability. Mitigation Mitigation for this issue is either...

CVE-2022-48982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: 71.986122 Call Trace: 71.986124 71.986125...

AZL-51443 CVE-2024-50029 affecting package kernel for versions less than 6.6.57.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix UAF in hcienhancedsetupsync This checks if the ACL connection remains valid as it could be destroyed while hcienhancedsetupsync is pending on cmdsync leading to the following trace: BUG: KASAN:...