Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btusb: Added a NULL check for “date-evtskb”. Fixed a crash due to NULL pointers. 6104.969662 BUG: NULL pointer dereferencing in the kernel; address: 00000000000000c8 6104.969667 PF: Supervisor read access in kernel...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fixed a potential issue after the “user-after-free” operation. This fix addresses all cases where allocating a buffer using allocskb might release the “chan lock”, and reacquiring it later could result in the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: bnep: Rejects short frames before parsing. A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately, and for control packets, it reads the control opcode and the setup UUID-size byte...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btsdio: fixed a use-after-free bug in btsdioRemove due to a race condition. In btsdioprobe, the data-work is bound to btsdiowork. It will be started in btsdiosendframe. If btsdio.Remove runs with an unfinished work,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed an issue where the cleanup of failed adv monitors was not performed properly. The hciaddadvmonitor function publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hciconn: A null pointer dereferencing occurred in hciabortconn. hciabortconn attempts to read hciskbeventhdev-sentcmd when a connection is pending. However, hdev-sentcmd can be NULL while reqstatus remains HCIREQPEN...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Race conditions in scosockconnect have been fixed. scosockconnect checks skstate and sktype without holding the socket lock. Two concurrent connect system calls on the same socket can both pass the check and enter...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: Fixed a double-free in ‘hcidiscoveryfilterclear’. The function ‘hcidiscoveryfilterclear’ frees the ‘uuids’ array and then sets it to NULL. There is a small chance that the following races will occur:...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A issue was discovered in l2capsockrelease in net/bluetooth/l2capsock.c in the Linux kernel before version 6.4.10. There is a use-after-free issue, as the children of a sk object are handled incorrectly...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Do not leave a dangling sk pointer after an error in l2capsockcreate. The btsockalloc function allocates the sk object and attaches it to the provided sock object. If an error occurs in l2capsockalloc, the sk...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: In virtiobt, there is a issue where skbPutskb, len is called before proper validation of len. len comes directly from virtqueuegetbuf, without any validation against the buffer that is posted to the device. The RX skb ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In hci, fix for null-ptr-deref in hcireadsupportedcodecs. Fix hcicmdsyncsk to return not NULL for unknown opcodes. hcicmdsyncsk returns NULL if a command returns a status event. However, it also returns NULL when an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Use deltimersync before freeing the timer. When checking a crash report regarding a corrupted timer list, it was found that this issue usually occurs when a timer is freed while still active. This problem is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: SMP: The requirement to enforce MITM Mutual Authentication, Mutual Encryption before generating the pairing response is now implemented. Currently, the smpcmdpairingreq function generates the pairing response based ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed UAF in isosocktimeout The conn-sk might have been unlinked/freed while waiting for isoconnlock. Therefore, this check determines whether conn-sk is still valid by verifying that it is part of isosklist...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: msft: fixed a slab-use-after-free in msftdoclose By tying the lifetime of msft-data to hdev by freeing it in hcireleasedev, the following issue was addressed: Use msftdoclose msft = hdev-msftdata; if !msft ...1...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1, Linux-5.10

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections support pairing in Bluetooth Core Specification 4.2 through 5.4. However, these devices are vulnerable to certain man-in-the-middle attacks, which force the use of a short key length. This vulnerability may lead to the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed use-after-free issue. Fixed potential use-after-free in l2caplecommandrej...