The vulnerability of the Zephyr real-time operating system’s Bluetooth protocol allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the Zephyr real-time operating system’s Bluetooth protocol lies in the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure or execute arbitrary code...

SUSE-SU-2023:3107-1 Security update for the Linux Kernel (Live Patch 30 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024129 fixes several issues. The following security issues were fixed: - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCAFLOWERKEYENCOPTSGENEVE packets in flsetgeneveopt in net/sched/clsflower.c bsc1212509. -...

The vulnerability of the Bluetooth microprogramming software-based Unisoc chipsets, related to synchronization errors when using shared resources, allows a hacker to trigger a service failure.

The vulnerability of the Bluetooth microprogramming software-based Unisoc chipsets is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to cause service failures...

Kernel: bluetooth: Unauthorized management command execution

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c

A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges...

PT-2023-18036 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue is related to a possible out of bounds write in the gatt end operation function of gatt utils.cc due to a missing bounds check. This could lead to remote code execution with no...

CVE-2023-21196

In btmblebatchscanfiltertrackadvvsecback of btmblebatchscan.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for...

CVE-2023-21181

In btmbleupdateinqresult of btmblegap.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that originates in btmblebatchscan.cc's btmblebatchscanfiltertrackadvvsecback, where out-of-bounds reads are possible due to incorrect bounds checking, which could lead to the...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that originates in btmblegap.cc in btmbleperiodicadvsynctxrcvd, where an out-of-bounds read is possible due to an incorrect bounds check, which could lead to the disclosure of local...

PT-2023-17991 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read due to a missing bounds check in the btm delete stored link key complete function of btm devctl.cc. This could lead to local information disclosure...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that stems from a possible out-of-bounds read due to a lack of bounds checking in btmdevctl.cc's btmdeletestoredlinkkeycomplete, which could lead to the disclosure of local informatio...

PT-2023-17989 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read in the on remove iso data path function of btm iso impl.h due to improper input validation. This could lead to local information disclosure with no...

The vulnerability of the Bluetooth technology implementation in Android devices based on MediaTek MT8167, MT8175, and MT8183 chips allows attackers to gain increased privileges.

The vulnerability of the Bluetooth technology implementation in Android devices based on MediaTek MT8167, MT8175, and MT8183 operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Bluetooth technology implementation in Android devices based on MediaTek MT8167, MT8175, and MT8183 chips allows attackers to gain increased privileges.

The vulnerability of the Bluetooth technology implementation in Android devices based on MediaTek MT8167, MT8175, and MT8183 operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2023-21115

In btmsecencryptchange of btmsec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c

A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol L2CAP, part of the Bluetooth stack in the l2capconnect and l2capleconnectreq functions. An attacker with physical access within the range of standard Bluetooth transmission could...

MediaTek 芯片 缓冲区错误漏洞

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the Bluetooth module of the MediaTek chips, which is caused by a lack of boundary checking and may allow out-of-bounds reads...

CVE-2022-24695

Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with...

PUB-A-260568359

In btmdeletestoredlinkkeycomplete of btmdevctl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure over Bluetooth with System execution privileges needed. User interaction is not needed for exploitation...