In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers a…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pend…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/35464ff818165131464bd524c259db1ac8044ae3
- https://git.kernel.org/stable/c/814f82f432dc6ee4d15f94756554ff94e6e3ef05
- https://git.kernel.org/stable/c/8f2f62855a41d1730fb9e8122912bd2c8d6bed5d
- https://git.kernel.org/stable/c/a9e7c2609b0cb3fb4b4ba9f66dd8727d33205967
- https://git.kernel.org/stable/c/eacfcb6b735d0e16b4d2ecfde4b9141225ee934e
Timeline
- nvd_ingest NVD