Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.17, 6.17.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a · fixed in 31d6c9216aa1be18ba317239738f73b0b0c7b691; From d71b98f253b079cbadc83266383f26fe7e9e103b · fixed in 5c19daa93d9af29f1f46251b47e1ea66bcc8d679; From 302a1f674c00dd5581ab8e493ef44767c5101aab · fixed in 1c9aca1787e8395a2c59fef20e914467958969c5; From 302a1f674c00dd5581ab8e493ef44767c5101aab · fixed in e8785404de06a69d89dcdd1e9a0b6ea42dc6d327; From 6.6.140 · fixed in 6.6.160; From 6.16.10 · fixed in 6.17
- Linux Linux
6.17
- KernelLinux
fixed in 6.6.160; From 6.7.0 · fixed in 6.17.8