Vulnerability in Bluetooth: hci_uart Package
Summary
GSD-2022-1001200: Bluetooth: hci_uart: add missing NULL check in h5_enqueue. Affects Kernel versions >= d9dd833cf6d29695682ec7e7924c0d0992b906bc, < 8a3896c30f542439d36303183dc96f65df8cc528. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth: hci_uart package is a component of the Linux Kernel ecosystem. It provides functionality for Bluetooth communication over UART (Universal Asynchronous Receiver-Transmitter) interfaces. This package is responsible for handling the transmission and reception of Bluetooth data between the host system and Bluetooth devices. However, a vulnerability has been discovered in the package that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the Bluetooth: hci_uart package is due to a missing NULL check in the h5_enqueue function. This vulnerability was introduced in version v5.15 of the Linux Kernel by commit d9dd833cf6d29695682ec7e7924c0d0992b906bc and affects all versions until v5.17.2, where it was fixed by commit 8a3896c30f542439d36303183dc96f65df8cc528. The missing NULL check could lead to a NULL pointer dereference, potentially resulting in a system crash or allowing an attacker to execute arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the Bluetooth: hci_uart package can potentially lead to system crashes or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.17.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a system crash to the execution of arbitrary code by an attacker.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix to mitigate any potential risks.
The vulnerability specifically affects the Bluetooth: hci_uart package in the Linux Kernel. However, it is always recommended to keep all software components up to date to ensure overall system security.
You can find more information about this vulnerability in the official Linux Kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
