59 matches found
CVE-2024-33052
Memory corruption when user provides data for FM HCI command control operations...
CVE-2024-33052
CVE-2024-33052 describes a memory corruption in the FM Host/HCI control path when data is provided for FM HCI commands. The vulnerability is tied to Qualcomm chipsets and is classified as local with low privileges and no user interaction, and the impact is rated high (confidentiality, integrity, ...
CVE-2024-33052 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations...
CVE-2024-33052 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations...
PT-2024-25095 · Qualcomm · 205 Mobile Firmware +228
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption when a user provides data for FM HCI command control operations. This can potentially lead to security risks. The...
SUSE CVE-2024-35933
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintelreadversion If hcicmdsynccomplete is triggered and skb is NULL, then hdev-reqskb is NULL, which will cause this issue...
UBUNTU-CVE-2024-35933
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintelreadversion If hcicmdsynccomplete is triggered and skb is NULL, then hdev-reqskb is NULL, which will cause this issue...
kernel: Bluetooth: Fix race condition in hci_cmd_sync_clear
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hcicmdsyncclear There is a potential race condition in hcicmdsyncwork and hcicmdsyncclear, and could lead to use-after-free. For instance, hcicmdsyncwork is added to the 'reqworkqueue' after...
PT-2024-21758 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: In the sendHciCommand function of bluetooth hci.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System...
Design/Logic Flaw
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...
PT-2023-16239 · Bluetooth · Bluetooth
Name of the Vulnerable Software and Affected Versions: Bluetooth software affected versions not specified Description: A malicious or defective Bluetooth controller can cause buffer overreads in most functions that process HCI command responses. Recommendations: At the moment, there is no...
CVE-2023-0396 Buffer Overreads in Bluetooth HCI
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...
CVE-2023-0396
CVE-2023-0396 describes a buffer overread in the Bluetooth controller’s handling of HCI command responses. The root cause is a malformed/defective Bluetooth controller causing overreads across many functions that process HCI responses. Documents consistently reference high impact on confidentiali...
PT-2025-26092
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel's Bluetooth functionality has been identified. When the HCI work queue is drained, only queue chained work is allowed, but another delayed work can...
Command injection
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...
CVE-2018-19860
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command...
CVE-2018-19860
CVE-2018-19860 affects Broadcom Bluetooth firmware (Nexus 5 BCM4335C0; Raspberry Pi 3 BCM43438A1; other Broadcom-based devices) prior to summer 2014. The issue is an improper restriction of LMP commands, allowing an LMP command to cause execution of memory contents, effectively enabling memory co...