Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.*s" and skb->len - 1.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 973bb97e5aee56edddaae3d5c96877101ad509c0 · fixed in be58b239d2be5da7a7fac11d3eb8bf75dce6511b; From 973bb97e5aee56edddaae3d5c96877101ad509c0 · fixed in bbc7de352f3f3864369c904aac944c7de84c6e7b; From 973bb97e5aee56edddaae3d5c96877101ad509c0 · fixed in c42ce5373405ca93946311652c51ccfeb1c2d913; From 973bb97e5aee56edddaae3d5c96877101ad509c0 · fixed in 673f707518e8ef03306f84c512cb160971f175fe; From 973bb97e5aee56edddaae3d5c96877101ad509c0 · fixed in 40eb4b18ad167b63644c27fa67a7400ba050379a
- Linux Linux
4.3
- KernelLinux
From 4.3.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10