Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can make the driver read past firmware->data while constructing TCI commands. Reject images shorter than the header and ensure that the ICCM and DCCM ranges fit within the loaded firmware before downloading either segment.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
37bac77e4649e8158698a60addc22ec4faf5649a to < 7733b01ed13685773ccda91035a46f87d4cfef7caffected37bac77e4649e8158698a60addc22ec4faf5649a to < e1534d49a7b8ba728e84b020f6d802aa1cb759d9affected37bac77e4649e8158698a60addc22ec4faf5649a to < 6c70253462902d835e843b470f74aa816d60af80affected37bac77e4649e8158698a60addc22ec4faf5649a to < 2763b8bcb504e30ec955474f51b99ce42fc62f3baffected37bac77e4649e8158698a60addc22ec4faf5649a to < 2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4affected
Linux Linux
Default version status: affected
6.12affected0 to < 6.12unaffected6.12.106 to ≤ 6.12.*unaffected6.18.47 to ≤ 6.18.*unaffected7.1.11 to ≤ 7.1.*unaffected7.2.1 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c ↗
- https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9 ↗
- https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80 ↗
- https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b ↗
- https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4 ↗