Design/Logic Flaw

The hidpsetuphid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call...

CVE-2013-0349

CVE-2013-0349 affects the Linux kernel’s HIDP path: hidp_setup_hid in net/bluetooth/hidp/core.c fails to copy a certain name field, enabling a local attacker to read sensitive kernel memory by setting an oversized name and issuing HIDPCONNADD. The issue exists in kernel versions before 3.7.6. Mit...