Multiple Connection Complete Events Vulnerability in Linux Kernel
Summary
GSD-2022-1001085: Bluetooth: hci_event: Ignore multiple conn complete events. Affects Kernel versions < aa1ca580e3ffe62a2c5ea1c095b609b2943c5269. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system. It provides essential functionality, such as managing system resources, device drivers, and communication between hardware and software. The Bluetooth subsystem in the Linux Kernel enables wireless communication between devices. It allows devices to connect, exchange data, and perform various operations over Bluetooth. However, a vulnerability has been discovered in the Bluetooth subsystem that can lead to multiple connection complete events being processed incorrectly.
Vulnerability Detail
The vulnerability in the Linux Kernel's Bluetooth subsystem occurs when multiple connection complete events are received. The system fails to handle these events properly, potentially leading to various security issues. An attacker could exploit this vulnerability to perform unauthorized actions, such as establishing unauthorized connections, intercepting data, or causing denial-of-service conditions. The impact and attack plausibility of this vulnerability have not been proven yet, but it is essential to address it to ensure the security of Bluetooth-enabled devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The Multiple Connection Complete Events Vulnerability in the Linux Kernel's Bluetooth subsystem can potentially lead to security risks, including unauthorized actions, data interception, or denial-of-service conditions. It is crucial to update the Linux Kernel to version v5.17.3 or later to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow unauthorized actions, data interception, or denial-of-service conditions.
You can use the Vulert Playground at Vulert Scanner to check if your Linux Kernel version is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities.
There are no known exploits for this vulnerability at the moment. However, it is crucial to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected device has Bluetooth enabled and is within range of the attacker.
No specific workaround is mentioned for this vulnerability. It is recommended to update the Linux Kernel to the latest version to address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
