CVE-2024-1638

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true ...

CVE-2024-11263

When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.

CVE-2023-7060

Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.

CVE-2024-3077

An malicious BLE device can crash BLE victim device by sending malformed gatt packet

CVE-2024-6259

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

CVE-2024-5931

BT: Unchecked user input in bap_broadcast_assistant

CVE-2024-6135

BT:Classic: Multiple missing buf length checks

CVE-2024-3332

A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device

CVE-2024-4785

BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero

CVE-2024-6442

In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.

CVE-2023-6249

Signed to unsigned conversion esp32_ipm_send

CVE-2024-6137

BT: Classic: SDP OOB access in get_att_search_list

CVE-2024-6444

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.

CVE-2024-8798

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.

CVE-2023-5779

can: out of bounds in remove_rx_filter function

CVE-2024-6258

BT: Missing length checks of net_buf in rfcomm_handle_data

CVE-2024-5754

BT: Encryption procedure host vulnerability

CVE-2024-6443

In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.

CVE-2023-6749

Unchecked length coming from user input in settings shell

CVE-2023-6881

Possible buffer overflow in is_mount_point