Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
57375beef71af9f245e88357fa71d9600650cb7d to < e9cf7f175c00d36b060828f4eac8d2e246ee079baffected57375beef71af9f245e88357fa71d9600650cb7d to < 83499ac3ca62e43ed40f7574b13ed398a6891511affected57375beef71af9f245e88357fa71d9600650cb7d to < 76948d207d0978a613ce06a05cba07284a5578a7affected57375beef71af9f245e88357fa71d9600650cb7d to < 5ec43df2830b73e004147303bf7914ca884d6770affected57375beef71af9f245e88357fa71d9600650cb7d to < a086c0892969bf8a0151b0f12bd14a68827c88b2affected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b ↗
- https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511 ↗
- https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7 ↗
- https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770 ↗
- https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2 ↗