Vulnerability in Kernel: arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for bluetooth
Summary
GSD-2022-1003045: arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for bluetooth. Affects Kernel versions < 2e34ab6e7df418372645a0fb7be5569d18b9c1fb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities and drivers for various devices. The vulnerability in question affects the arm64 architecture and specifically the device tree source (DTS) for the Qualcomm Snapdragon 7280 IDP (In-Development Platform). This vulnerability pertains to the configuration of the CTS (Clear To Send) pin for Bluetooth, which is not properly set to bias-bus-hold. This misconfiguration could potentially lead to security issues and compromise the integrity and confidentiality of Bluetooth communications on devices utilizing this kernel.
Vulnerability Detail
The vulnerability arises from the incorrect configuration of the CTS pin for Bluetooth on the Qualcomm Snapdragon 7280 IDP. By not setting the pin to bias-bus-hold, potential security risks may emerge. Attackers could exploit this misconfiguration to intercept or manipulate Bluetooth communications, potentially leading to unauthorized access, data leakage, or other malicious activities. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Kernel's arm64 architecture, specifically in the Qualcomm Snapdragon 7280 IDP's device tree source, poses potential security risks by misconfiguring the CTS pin for Bluetooth. To address this issue, it is crucial to update the Linux Kernel to version v5.17.14 or later, which includes the necessary fix. Regularly applying security updates is essential to ensure the integrity and confidentiality of Bluetooth communications on affected devices. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially include unauthorized access, data leakage, and manipulation of Bluetooth communications on devices utilizing the affected Kernel.
You can check the version of the Linux Kernel installed on your system. If it is earlier than v5.17.14, your system may be vulnerable. Additionally, you can use tools like Vulert (https://vulert.com) to scan your system and identify any potential vulnerabilities.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to apply the recommended fix to mitigate any potential risks.
The exact attack vectors and remote exploitability of this vulnerability have not been established. However, it is always advisable to apply security updates promptly to minimize potential risks.
Currently, there is no known workaround for this vulnerability. It is recommended to update the Linux Kernel to the fixed version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
