Описание
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: qca: fix info leak when fetching fw build id
Add the missing sanity checks and move the 255-byte build-id buffer off
the stack to avoid leaking stack data through debugfs in case the
build-info reply is malformed.
A flaw was found in the Linux kernel's Qualcomm Atheros Bluetooth (QCA) driver. Due to missing validation checks when retrieving firmware build identifiers, a malformed response can leave uninitialized memory in a buffer exposed through the debug filesystem (debugfs). A local user with access to debugfs could exploit this flaw to inspect sensitive kernel stack contents, leading to information disclosure.
Отчет
This vulnerability is rated as having Low severity for Red Hat because successful exploitation requires local administrative access to debugfs and the presence of physical Qualcomm Atheros Bluetooth hardware. The exposure is limited to disclosing uninitialized kernel memory without granting privilege escalation or causing a denial of service. Additionally, debugfs access is restricted to root by default across Red Hat Enterprise Linux deployments, substantially constraining unprivileged attack vectors.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
2.3 Low
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed.
In the Linux kernel, the following vulnerability has been resolved: B ...
Уязвимость компонента qca ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании (DoS)
EPSS
2.3 Low
CVSS3