Astra Linux – Vulnerability in Linux 5.10, Linux

A issue was discovered in the Linux kernel through version 6.0.10. In the l2capconfigreq function within net/bluetooth/l2capcore.c, there is an integer wraparound occurring when processing L2CAPCONFREQ packets...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btsdio: fixed a use-after-free bug in btsdioRemove due to a race condition. In btsdioprobe, the data-work is bound to btsdiowork. It will be started in btsdiosendframe. If btsdio.Remove runs with an unfinished work,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: validate the length of the advertising payload sent via meshsend The meshsend function currently limits the MGMTOPMESHSEND operation based on the total command length. However, it does not verify whether the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcievent: Fixed a potential Use-after-Allocation UAF issue in hcileremoteconnparamreqevt. Field access related to hciconn must be protected by the hcidevlock mechanism in hcileremoteconnparamreqevt. Otherwise, it’s...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed a potential use-after-free when using clear keys. Similar to the commit c5d2b6fa26b5 “Bluetooth: Fixed a use-after-free in hciremoveltk/hciremoveirk”. We cannot access k after the kfreercu call...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciconn: fails to handle SCO/ISO via hciconnfailed if the ACL is deleted prematurely. Not calling hcidisconnectcfm before deleting a connection referenced by a socket generally results in a “use-after-free” issue...

Astra Linux – Vulnerability in Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: afbluetooth: Fixed deadlock issues Attempting to use socklock on .recvmsg may cause a deadlock as shown below. Therefore, instead of using socksock, use skreceivequeue.lock on btsockioctl to avoid UAF: INFO: Task...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcildisc,serdev: failure in checking percpuinitrwsem syzbot reports a NULL pointer dereferencing at hciuartttyclose 1. For rcusyncenter, percpuinitrwsem is called without rcusyncinit, because hciuartttyopen ignores...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

A race condition was detected in the Linux kernel’s net/bluetooth code within the sniffmin,maxintervalset function. This can lead to a Bluetooth sniffing exception issue, potentially causing a denial of service...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: It is necessary to call deltimersync before freeing a timer. A crash report indicated that the timer list might become corrupted when a timer is freed while still active. This issue is commonly caused by code...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

A race condition was detected in the Linux kernel’s net/bluetooth in the conn,advmin,maxintervalset function. This can lead to issues with I2cap connections or broadcasts, potentially causing denial of service...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Potential use-after-free issues have been avoided in hcierrorreset. When handling the HCIEVHARDWAREERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism will free the hcidev, leading ...

Astra Linux – Vulnerability in Linux, BlueZ

In the Bluetooth Core Specification 2.1 through 5.2, Bluetooth LE and BR/EDR secure pairing mechanisms may allow a nearby man-in-the-middle attacker to identify the Passkey used during pairing in the Passkey authentication procedure by reflecting the public key and the authentication evidence of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed issues related to locking and validity checks for isoconn. sk-skstate indicates whether isopisk-conn is valid. Operations that check or update skstate and access conn should hold locksock; otherwise, they...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btmtksdio: Fixed a kernel oops in btmtksdiointerrupt. Fixed the following kernel oops in btmtksdiointerrrupt: 14.339134 btmtksdiointerrupt+0x28/0x54 14.339139 processsdiopendingirqs+0x68/0x1a0 14.339144...

Astra Linux – Vulnerability in Linux 5.10, Linux

A vulnerability, classified as critical, was discovered in the Linux kernel. The affected function is l2capconndel in the file net/bluetooth/l2capcore.c of the Bluetooth component. This vulnerability allows for exploitation after the memory allocation has been freed. It is recommended that patche...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fixed handling of HCIEVIOCAPAREQUEST. If we receive HCIEVIOCAPAREQUEST while HCIOPREADREMOTEEXTFEATURES has not yet been responded to, assume that the remote supports SSP. Otherwise, this event should not be...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: msft: Fixed memory leak Fixed the buffer leakage issue when sending MSFTOPLEMONITORADVERTISEMENT...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fixed an issue where the function deviceadd was called multiple times. The function deviceadd should not be called multiple times, as stated in its documentation: “Do not call this routine or deviceregister...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: For qca devices, a bug was fixed where a NULL pointer dereferencing occurred in cases where no SERVICE mode was set. Qualcomm ROME controllers can be registered through the Bluetooth interface. In this case, the HCI...