Bluetooth: hci_aml: validate firmware segment lengths
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.2%
probabilidad de explotación
0.2%top 90% de las CVE
explotación observada
noninguna fuente lo reporta
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_aml: validate firmware segment lengths
aml_download_firmware() reads two lengths from the firmware header and
uses them to build pointers before checking that the header and segment
data are present. A truncated or inconsistent firmware image can make
the driver read past firmware->data while constructing TCI commands.
Reject images shorter than the header and ensure that the ICCM and DCCM
ranges fit within the loaded firmware before downloading either segment.
Productos afectados
Linux · LinuxReferencias
https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3bhttps://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7chttps://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9