Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow and turn the copy into an oversized read and write during Bluetooth setup. The existing patch_offset + patch_length check can also wrap on 32-bit architectures. Validate the patch length and range without arithmetic overflow before allocating or copying the patch.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
db33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < 39e01b4addfbbe177567d6ed1dfb81f9cccb19e6affecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < bda3c598ade6ea03884074b91e31608326684921affecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < a4cb830e0b55ac76c849fd7840afb251f4c028faaffecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < 68c5a2a19987c035eb129e627e579adafb04f637affecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < 83534891c058ed71e251135072640911670869aaaffecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < 6744ab60dfac55d1df5733960aad5be300984301affecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < f1ca750c0510bdbb504bf084d2f196ef2af92ea6affecteddb33c77dddc2ed2cff3061d0b096a9f5ab0c3647 to < 609c5b04a28dc1b0f3af6a7bc93055135b2d2059affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6 ↗
- https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921 ↗
- https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa ↗
- https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637 ↗
- https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa ↗
- https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301 ↗
- https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6 ↗
- https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059 ↗