High · published July 30, 2024
In the Linux kernel, the following vulnerability has been resolved:
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
Syzbot hit warning in hci_conn_del() caused by freeing handle that was
not allocated using ida allocator.
This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by
hci_le_big_sync_established_evt(), which makes code think it's unset
connection.
Add same check for handle upper bound as in hci_conn_set_handle() to
prevent warning.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 6.5.12, < 6.6 | 6.6 |
| linux/linux_kernel | ≥ 6.6.2, < 6.6.39 | 6.6.39 |
| linux/linux_kernel | ≥ 6.7, < 6.9.9 | 6.9.9 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |