70 matches found
CVE-2023-53046
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hcicmdsyncclear There is a potential race condition in hcicmdsyncwork and hcicmdsyncclear, and could lead to use-after-free. For instance, hcicmdsyncwork is added to the 'reqworkqueue' after...
UBUNTU-CVE-2023-53046
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hcicmdsyncclear There is a potential race condition in hcicmdsyncwork and hcicmdsyncclear, and could lead to use-after-free. For instance, hcicmdsyncwork is added to the 'reqworkqueue' after...
UBUNTU-CVE-2023-53018
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leaks When hcicmdsyncqueue failed in hcileterminatebig or hcilebigterminate, the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path...
CVE-2023-53018 Bluetooth: hci_conn: Fix memory leaks
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leaks When hcicmdsyncqueue failed in hcileterminatebig or hcilebigterminate, the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path...
CVE-2024-33052
Memory corruption when user provides data for FM HCI command control operations...
DEBIAN-CVE-2024-53207
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible deadlocks This fixes possible deadlocks like the following caused by hcicmdsyncdequeue causing the destroy function to run: INFO: task kworker/u19:0:143 blocked for more than 120 seconds. Tainted: G ...
SUSE CVE-2024-50255
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hcireadsupportedcodecs Fix hcicmdsyncsk to return not NULL for unknown opcodes. hcicmdsyncsk returns NULL if a command returns a status event. However, it also returns NULL where an opcode...
CVE-2024-33052
Memory corruption when user provides data for FM HCI command control operations...
CVE-2024-33052 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations...
CVE-2024-33052
CVE-2024-33052 describes a memory corruption in the FM Host/HCI control path when data is provided for FM HCI commands. The vulnerability is tied to Qualcomm chipsets and is classified as local with low privileges and no user interaction, and the impact is rated high (confidentiality, integrity, ...
CVE-2024-33052 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations...
CVE-2024-33052: Buffer Copy without Checking Size of Input
Memory corruption when user provides data for FM HCI command control operations...
PT-2024-25095 · Qualcomm · 205 Mobile Firmware +228
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption when a user provides data for FM HCI command control operations. This can potentially lead to security risks. The...
SUSE CVE-2024-35933
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintelreadversion If hcicmdsynccomplete is triggered and skb is NULL, then hdev-reqskb is NULL, which will cause this issue...
UBUNTU-CVE-2024-35933
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintelreadversion If hcicmdsynccomplete is triggered and skb is NULL, then hdev-reqskb is NULL, which will cause this issue...
kernel: Bluetooth: Fix race condition in hci_cmd_sync_clear
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hcicmdsyncclear There is a potential race condition in hcicmdsyncwork and hcicmdsyncclear, and could lead to use-after-free. For instance, hcicmdsyncwork is added to the 'reqworkqueue' after...
PT-2024-21758 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: In the sendHciCommand function of bluetooth hci.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System...
Design/Logic Flaw
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses...
PT-2023-16239 · Bluetooth · Bluetooth
Name of the Vulnerable Software and Affected Versions: Bluetooth software affected versions not specified Description: A malicious or defective Bluetooth controller can cause buffer overreads in most functions that process HCI command responses. Recommendations: At the moment, there is no...