Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers. However, the implementation simply breaks from a switch statement and leaks uninitialized return code `rc' (if the first section is a security one) or the previous section's `rc'. Fix it by really skipping a loop with `continue'. For consistency and readability, also do the same for the default case.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa to < ba96047bba4a6101267cf4f6b3057cbc58e6c554affected9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa to < 90f3a142b5f8596a565b8e080d18a8050be6edefaffected9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa to < 422f6547259654bae690713614c794dd1e2c0a0baffected9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa to < c4249cf6e80b1bd62a6a409aaabe760fe025dac3affected9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa to < 83e3e515fd261600ed8491fb0a8bcdfb115c904eaffected
Linux Linux
Default version status: affected
6.4affected0 to < 6.4unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ba96047bba4a6101267cf4f6b3057cbc58e6c554 ↗
- https://git.kernel.org/stable/c/90f3a142b5f8596a565b8e080d18a8050be6edef ↗
- https://git.kernel.org/stable/c/422f6547259654bae690713614c794dd1e2c0a0b ↗
- https://git.kernel.org/stable/c/c4249cf6e80b1bd62a6a409aaabe760fe025dac3 ↗
- https://git.kernel.org/stable/c/83e3e515fd261600ed8491fb0a8bcdfb115c904e ↗